Cryptojacking
A type of cybercrime where an attacker secretly uses a victim's computing power to mine cryptocurrency.
Cryptojacking surged in popularity around 2017 with the release of Coinhive, a service that offered website owners a script to mine Monero using visitors' CPUs as an alternative to displaying ads. Coinhive was heavily abused by hackers who injected it into hacked websites. Although Coinhive shut down in 2019, cryptojacking remains a top cybersecurity threat.
Defense strategies include network monitoring (looking for connections to known mining pools), endpoint protection, browser extensions that block mining scripts, and strict IAM (Identity and Access Management) policies for cloud infrastructure.
graph LR
Center["Cryptojacking"]:::main
Rel_cryptographic_hashing["cryptographic-hashing"]:::related -.-> Center
click Rel_cryptographic_hashing "/terms/cryptographic-hashing"
Rel_cryptocurrency_investigations["cryptocurrency-investigations"]:::related -.-> Center
click Rel_cryptocurrency_investigations "/terms/cryptocurrency-investigations"
Rel_blockchain_forensics["blockchain-forensics"]:::related -.-> Center
click Rel_blockchain_forensics "/terms/blockchain-forensics"
classDef main fill:#7c3aed,stroke:#8b5cf6,stroke-width:2px,color:white,font-weight:bold,rx:5,ry:5;
classDef pre fill:#0f172a,stroke:#3b82f6,color:#94a3b8,rx:5,ry:5;
classDef child fill:#0f172a,stroke:#10b981,color:#94a3b8,rx:5,ry:5;
classDef related fill:#0f172a,stroke:#8b5cf6,stroke-dasharray: 5 5,color:#94a3b8,rx:5,ry:5;
linkStyle default stroke:#4b5563,stroke-width:2px;
🧠 Knowledge Check
🧒 Explain Like I'm 5
Imagine someone secretly attaches a hose to your car's gas tank and uses your gas to run their own generator. You might not notice at first, but your car runs slower, the engine overheats, and you have to pay a much higher gas bill. Cryptojacking is exactly like that, but instead of gas, hackers steal your computer's processing power to 'mine' digital money for themselves.
🤓 Expert Deep Dive
Targeting CPU-Friendly Coins
Cryptojacking rarely targets Bitcoin because BTC mining requires specialized ASIC hardware; a hijacked CPU would yield virtually zero profit. Instead, attackers target ASIC-resistant, privacy-focused coins like Monero (XMR). Monero's RandomX Proof-of-Work algorithm is specifically optimized for general-purpose CPUs, making standard servers, laptops, and IoT devices highly profitable targets.
Infection Vectors
- Host-based (Malware): Installed via phishing, malicious downloads, or unpatched software vulnerabilities (e.g., exploiting Log4j to drop a miner payload).
- Browser-based (Drive-by): Exploits WebAssembly (Wasm) to run mining scripts (like the infamous Coinhive script) directly in a victim's browser when they visit a compromised webpage.
- Cloud-jacking: Attackers compromise AWS/Azure credentials or vulnerable Docker containers to deploy mining clusters at the victim's expense, leading to massive cloud computing bills.
❓ Frequently Asked Questions
How do I know if my computer has been cryptojacked?
Common symptoms include: the cooling fan constantly running at high speed, the device overheating, the battery draining unusually fast, and the CPU usage sitting at 90-100% even when you aren't running heavy applications.
Why do cryptojackers mine Monero instead of Bitcoin?
Bitcoin requires expensive, specialized hardware (ASICs) to mine profitably. A regular computer CPU cannot mine Bitcoin effectively. Monero uses an algorithm (RandomX) specifically designed to be mined on standard CPUs, making regular computers perfect targets for hackers.
Can cryptojacking happen just by visiting a website?
Yes. This is called 'browser-based' or 'drive-by' cryptojacking. The hacker injects a JavaScript or WebAssembly mining script into a compromised website. While you have the tab open, the script uses your CPU to mine. It stops as soon as you close the browser.