Cryptomining Malware (also called cryptojacking malware) is malicious software that secretly hijacks a victim’s computing resources – CPU, GPU, memory, and electricity – to mine cryptocurrency for the attacker’s benefit, without the owner’s knowledge or consent. Cryptocurrency mining is a legitimate but resource-intensive process that solves complex computations to validate transactions and earn coins; cryptomining malware steals other people’s computing power to perform this work, so the attacker reaps the rewards while the victim bears the cost.
Attackers deploy it through familiar infection vectors: malicious downloads and attachments, compromised websites that run mining scripts in visitors’ browsers (browser-based cryptojacking), exploited software vulnerabilities, and, increasingly, compromised cloud and container environments where large amounts of computing power can be commandeered. Misconfigured cloud accounts, exposed APIs, and vulnerable servers are attractive targets because they offer scale – attackers can spin up substantial mining operations on someone else’s infrastructure and bill.
Unlike ransomware, which announces itself, cryptomining malware is designed to stay hidden and run as long as possible, quietly consuming resources. Signs of infection include noticeably degraded performance, overheating, increased power consumption, and – in cloud environments – unexpectedly high compute bills. Because it does not typically destroy or exfiltrate data, victims may not notice for a long time, which is precisely the attacker’s goal: sustained, stealthy profit.
The impact includes wasted computing resources, higher energy and cloud costs, hardware wear from sustained heavy load, degraded performance for legitimate workloads, and the fact that a foothold enabling cryptomining could be repurposed for more damaging attacks. For organizations, unexplained resource consumption in cloud and container environments is a key warning sign.
Defenses include standard malware protection (endpoint security, patching, and safe browsing), monitoring for abnormal resource usage and unexpected processes, securing cloud configurations and APIs against compromise, restricting who can create compute resources, and using browser protections against in-browser mining scripts. In cloud-native environments, monitoring for anomalous compute consumption is one of the more reliable ways to catch cryptomining that would otherwise run undetected.