Cryptojacking detection is the practice of finding unauthorized cryptocurrency mining that an attacker has hidden on your computers, servers, cloud accounts, or websites. The attacker earns the mining rewards, while you pay for the electricity, hardware wear, and computing resources.
Unlike ransomware, cryptojacking is designed to stay quiet for as long as possible, so it can run unnoticed for a long time. This guide explains how hidden miners get in, the signals that reveal them on endpoints, networks, and cloud platforms, and how to respond and prevent reinfection.
What Cryptojacking Looks Like From the Inside
Cryptocurrency mining is the process of performing computations to compete for the right to add blocks in a proof-of-work blockchain, earning a reward. Mining legitimately requires significant computing power and energy, which is exactly why attackers prefer to use someone else’s.
Picture a company web server that suddenly runs hot, responds slowly, and shows sustained high processor usage at night when traffic is low. Nobody deployed anything new. An investigation finds an unfamiliar process with a generic name, connecting persistently to an external address.
That scenario captures the essence of cryptojacking. Nothing is visibly stolen, and no files are encrypted. Instead, the attacker quietly converts your resources into income for themselves. The harm appears as higher costs, degraded performance, shortened hardware lifespan, and a compromised system that could be used for worse purposes later.
For detection teams, the key insight is that mining leaves physical and financial traces. Computation consumes power, generates heat, and costs money, and those effects are difficult for any attacker to hide completely.
How Hidden Miners Get Onto Systems
Cryptojacking relies on the same intrusion methods as other attacks. Servers with unpatched vulnerabilities in web applications, content management systems, or remote management services are frequent targets. Once attackers gain access, installing a miner is often their first step.
Cloud environments face additional risks. Exposed access keys in public code repositories, weak passwords on management consoles, and misconfigured container platforms with open management interfaces can let attackers launch new instances or containers dedicated to mining. These workloads may run in regions the organization never uses.
Endpoints become infected through bundled software, malicious downloads, or browser extensions. Websites can also host mining scripts that run in visitors’ browsers, either deliberately or after a site has been compromised. Understanding these entry points tells defenders where to look first when signs of mining appear.
Why Cryptojacking Often Goes Unnoticed
Attackers design miners to avoid attention. Some limit processor usage to a fraction of capacity so the slowdown feels like ordinary aging hardware. Others pause mining when a user is active or when monitoring tools are open, resuming once the system is idle.
Disguise is common. Miner processes may adopt names resembling legitimate system services, run from temporary directories, or hide inside containers that look like normal workloads. On servers without regular monitoring, high processor usage may simply be assumed to be normal application load.
Organizational gaps add to the problem. Cloud bills may be reviewed monthly by finance staff who do not know which workloads are expected. Performance complaints may be handled as capacity issues by adding resources, which unintentionally gives the miner more to use. Effective detection depends on connecting these signals across teams.
Performance Clues on Endpoints and Servers
Resource usage is the most visible sign of mining. While each clue has innocent explanations, a combination deserves investigation.
- Sustained high processor or graphics usage when the system should be idle.
- Fans running loudly, devices overheating, or laptop batteries draining unusually fast.
- Slower response times for applications and services without a change in workload.
- Unfamiliar processes consuming large amounts of computing time.
- Unexpected increases in electricity or cloud usage costs.
Establishing a baseline makes these clues meaningful. If you know how a server normally behaves across a typical day, a sustained deviation stands out quickly. Without a baseline, defenders often struggle to tell whether a busy system is under attack or simply under load.
Network Indicators of Mining Activity
Most miners join a mining pool, a service that combines the computing power of many participants and shares the rewards. To do so, the miner maintains a connection to the pool’s servers, which creates network patterns that defenders can monitor.
Many pools use the Stratum protocol, a lightweight communication method for distributing mining work. Stratum traffic often appears as long-lived connections carrying small, regular messages. Some defenders detect it by inspecting traffic for its characteristic message format, although encryption can make this harder.
DNS requests are another valuable signal. A DNS lookup translates a domain name into an IP address, and lookups for known mining pool domains from servers that have no reason to contact them are a strong indicator. Threat intelligence feeds that list pool domains and addresses help automate this check, though attackers may use proxies to avoid detection.
Detection in Different Environments
Cryptojacking takes different forms depending on where it runs. Each environment offers its own detection signals and tools.
Browser-Based Mining
Some mining scripts run inside web pages using JavaScript or WebAssembly. They consume processing power only while the page stays open. Signs include high usage tied to a specific browser tab and sustained activity on pages that should be static.
Browser task managers, content security policies, and extensions that block known mining scripts help both users and site owners detect this activity.
Cloud and Container Workloads
In the cloud, look for new instances, containers, or functions that nobody requested, especially in unused regions or with powerful hardware types. Billing alerts and budget thresholds act as early warnings. Cloud audit logs, which record who created or changed resources, help trace unauthorized launches to the credentials that were used.
Endpoints and On-Premises Servers
On traditional machines, examine running processes, scheduled tasks, startup entries, and services for unfamiliar items. Miners frequently add persistence mechanisms so they restart after a reboot. Endpoint detection and response tools can flag processes with mining behavior, such as sustained computation combined with outbound pool connections.
Comparing installed software against an approved inventory quickly highlights binaries that nobody deployed.
Investigating a Suspicious Host
When signals point to a specific system, a structured investigation confirms whether mining is present and how it arrived. Start by identifying the processes using the most resources and noting their file locations, owners, and parent processes. Miners launched from temporary folders or unusual user accounts deserve close attention.
Next, look for persistence. Common mechanisms include scheduled tasks, cron jobs on Linux systems, new services, modified startup scripts, and container images configured to restart automatically. Record what you find before removing anything, because these details reveal the attacker’s methods and the scope of the compromise.
Check for related activity as well. Attackers who install miners may also add user accounts, place remote access keys, or disable security tools. Reviewing authentication logs and recent configuration changes helps determine whether the miner is the only problem or a symptom of deeper access.
Tools That Support Detection
Several categories of security tools help detect cryptojacking at scale. Endpoint detection and response platforms monitor process behavior on devices and can recognize mining patterns. Security information and event management systems, known as SIEM, collect logs from many sources and correlate signals across the environment.
Network security tools add visibility into outbound connections, DNS queries, and traffic patterns associated with mining pools. Cloud providers offer native threat detection services that flag suspicious activity, such as instances communicating with known mining infrastructure or unusual API calls from unfamiliar locations.
Tools are only as useful as the attention given to their alerts. Tune rules to reduce noise, assign clear ownership for responding to mining-related findings, and integrate cloud billing alerts into the same workflow as security alerts. Connecting cost signals with security monitoring is one of the most effective ways to catch cloud cryptojacking early.
A Cryptojacking Detection Checklist
A repeatable checklist helps teams investigate consistently. Adapt the following steps to your environment and review them periodically.
- Compare current processor, graphics, and power usage against established baselines.
- Review running processes, services, and scheduled tasks for unfamiliar entries.
- Check DNS and network logs for connections to known mining pools or unusual long-lived sessions.
- Audit cloud accounts for unexpected resources, regions, and billing spikes.
- Scan websites and front-end code for unauthorized scripts.
- Review recent authentication activity and configuration changes on affected systems.
Running this checklist after any performance anomaly turns a vague suspicion into a clear finding. Documenting the results also creates a record that helps identify patterns, such as repeated infections through the same vulnerable service.
Responding to Confirmed Cryptojacking
Once mining is confirmed, isolate the affected system to stop further abuse and prevent the attacker from moving to other machines. In cloud environments, revoke compromised credentials immediately and shut down or quarantine unauthorized resources, preserving logs and snapshots for investigation.
Determine how the attacker got in before declaring the incident closed. Removing the miner without fixing the entry point usually leads to reinfection, sometimes within hours. Patch the exploited vulnerability, rotate passwords and access keys, and remove any accounts or remote access keys the attacker added.
For servers and endpoints, rebuilding from a trusted image is often safer than cleaning in place, because miners may be accompanied by backdoors. Afterward, monitor the restored systems closely. Report the incident internally and, where relevant, to your cloud provider, which may assist with investigation and billing review.
Preventing Miners From Returning
Prevention focuses on closing the doors attackers use. Keep operating systems, applications, and container images patched. Restrict management interfaces so they are not reachable from the internet, and require strong authentication, including multi-factor authentication, for administrative access.
Protect cloud credentials carefully. Avoid storing access keys in code, scan repositories for exposed secrets, and apply the principle of least privilege, which means granting each user or service only the permissions it truly needs. Restricting which regions and instance types can be launched limits what an attacker can do with stolen credentials.
For websites, use content security policies that limit which scripts can run, and monitor front-end files for unexpected changes. On endpoints, application allowlisting and careful software sourcing reduce the chance that a bundled miner ever executes in the first place.
Strengthening Long-Term Monitoring
Cryptojacking detection improves with continuous attention rather than one-time checks. Maintain performance baselines, keep billing alerts active, and review mining-related detections as part of regular security operations. Each investigation should feed back into better rules and faster responses.
Assign clear ownership for each environment. When someone is responsible for reviewing server performance, cloud spending, and website integrity, early warning signs are far less likely to slip between teams.
Treat cryptojacking as a sign of broader exposure. A system that an attacker can use for mining is a system they could use for data theft or ransomware. Fixing the underlying weakness protects against those more damaging outcomes too.
For a wider view of how attackers target crypto users and infrastructure, related guides on blockchain malware risks and clipboard hijacking cover adjacent threats. Combined with solid patching and credential hygiene, steady monitoring keeps your computing resources working for you rather than for someone else.