Cryptojacking

Cryptojacking is the unauthorised use of another person's or organisation's computing resources to mine cryptocurrency. Attackers install mining software on victims' computers, phones, servers or cloud accounts, or run mining scripts in web browsers, without permission. The victim pays for the electricity, hardware wear and cloud bills, while the attacker collects the coins. Because the goal is to stay hidden for as long as possible, cryptojacking is often less visible than other cyber attacks such as ransomware.

Cryptojacking usually targets coins that can be mined profitably on ordinary processors, especially Monero, whose mining algorithm is designed to favour general-purpose CPUs and whose privacy features make the proceeds harder to trace. It became widespread in 2017 and 2018, when crypto prices were high and browser-based mining tools were easy to use, and it remains a common threat to poorly secured cloud infrastructure.

Imagine someone secretly plugging a hidden extension lead into your house and running their own factory machines on your electricity. You notice your bills going up and your lights flickering, but you cannot see why. Cryptojacking is the computer version: someone runs a money-making machine on your computer without asking.

The "machine" is mining software, which solves puzzles to earn cryptocurrency. It makes your device slower and hotter and uses more power. If the victim is a company with rented cloud servers, the attacker can run thousands of machines on the company's account, and the company only finds out when a huge bill arrives.

Attackers use several methods:

• Malware. Mining programs are installed through infected downloads, email attachments or phishing links, sometimes alongside other malicious software.
• Browser scripts. JavaScript code embedded in websites or advertisements mines while the visitor has the page open, sometimes on hacked sites without the owner's knowledge.
• Cloud and server compromise. Attackers use stolen credentials, exposed management interfaces or unpatched software to launch mining workloads on cloud accounts and container platforms.
• Botnets. Large networks of infected devices, including routers and smart devices, are pooled to mine together, often through a mining pool.

Miners are usually configured to use only part of the processor's capacity to avoid detection, and some pause when the user opens monitoring tools.

Coinhive, a service launched in 2017, offered website owners a script to mine Monero in visitors' browsers as an alternative to advertising; it was widely abused by attackers who injected it into hacked sites, and the service shut down in March 2019. In 2018, security researchers reported that attackers had used an unprotected administrative console to run mining software on Tesla's cloud account. Government and university websites in several countries were found serving mining scripts through compromised plug-ins. Security firms have since reported repeated waves of attacks on misconfigured cloud and container systems, often by organised groups.

Warning signs include unexplained slowness, overheating, fans running constantly, rapid battery drain, high processor usage in system monitors and unexpected spikes in cloud computing or electricity costs. For businesses, cryptojacking means wasted resources and higher bills, but it is also evidence of a security breach: an attacker able to install miners may be able to steal data or deploy more damaging malware. Heavy mining can shorten the life of hardware and, on phones, cause physical damage from heat.

Defences include keeping software and systems patched, using anti-malware tools and browser extensions that block known mining scripts, restricting and monitoring cloud credentials, setting spending alerts and limits on cloud accounts, and watching for unusual network connections to mining pools. Organisations also apply standard practices such as least-privilege access and multi-factor authentication. In many countries, cryptojacking is prosecuted as unauthorised access to computer systems, a form of hacking. Browser makers have also added protections: several mainstream browsers block known mining scripts by default or throttle pages that use the processor heavily in the background, which has made browser-based cryptojacking much less common than at its 2018 peak. Attackers have responded by focusing on servers and cloud accounts, where a single breach can provide far more computing power. The legitimate equivalent, renting computing power with the owner's consent, is described under cloud mining, and the mining process itself under crypto mining and CPU miner.