Cryptojacking

What it is

Cryptojacking is unauthorized use of computing resources to mine cryptocurrency. The victim pays through electricity, degraded performance, or cloud charges while the operator receives the reward. It can affect personal devices, servers, containers, or cloud accounts. High resource usage alone is not proof of mining, but unexplained usage deserves investigation.

How it works

An attacker compromises a workload or credential and starts mining software. In cloud environments they may create additional resources under your account. Some deployments throttle activity to avoid detection. The miner is a symptom of unauthorized access that may also support data theft or other attacks.

How people get tricked

Heat and slowdowns can look like ordinary workloads, and cloud costs may be discovered only at billing time. The initial entry may involve deception, but exposed services or stolen keys can be exploited without user interaction.

Example scenario

A leaked cloud key lets an attacker start large compute instances. Your application still works, but usage and costs rise far beyond the expected deployment.

Warning signs

• Unexpected sustained CPU or GPU use by unknown processes.
• Unapproved cloud resources, regions, or billing spikes.
• Connections and workloads inconsistent with the system's intended job.

If it happens to you

Stop unauthorized workloads, revoke compromised credentials, and investigate how access was gained. Review other actions taken under the same identity and contact the cloud provider about suspicious charges. Removing only the miner leaves the attacker free to restart it.