What is Cryptojacking?

Cryptojacking is a cyberattack in which attackers secretly use a victim’s computing resources to mine cryptocurrency without the owner’s knowledge or consent. Understanding what is cryptojacking helps organizations recognize how attackers abuse compromised endpoints, servers, browsers, and cloud workloads to generate cryptocurrency while consuming CPU, memory, and power resources. Unlike ransomware, cryptojacking focuses on quietly exploiting computing capacity rather than disrupting access to systems or data.

Why does it matter?

Cryptojacking can affect system performance, increase infrastructure costs, and reduce the availability of business-critical resources. Because the malware often operates quietly, organizations may not detect it immediately.

Attackers use this to:

• Mine cryptocurrency without paying for resources
• Exploit compromised endpoints
• Abuse cloud computing resources
• Increase financial gain
• Maintain long-term access to affected systems

These attacks can impact organizations of any size that operate internet-connected systems.

How does it work?

Attackers typically install mining software after compromising a device or exploiting a vulnerable application. The malware runs in the background and consumes available computing resources to perform cryptocurrency mining.

A typical attack flow includes:

• The attacker compromises a system.
• Mining software is deployed.
• The malware begins using system resources.
• Cryptocurrency mining starts in the background.
• System performance gradually declines.
• The attacker receives cryptocurrency rewards.

The attack often continues until security teams identify and remove the malware.

What signs indicate cryptojacking?

Although cryptojacking often avoids obvious disruption, affected systems usually display unusual resource consumption.

These indicators help security teams identify systems that may require investigation.

How can organizations reduce cryptojacking risk?

Organizations should combine preventive controls with continuous monitoring to detect unauthorized cryptocurrency mining activity. Common security practices include:

• Keep operating systems and applications updated
• Restrict unauthorized software execution
• Monitor endpoint resource utilization
• Apply least privilege access
• Detect unusual process activity
• Conduct regular endpoint security assessments
• Educate users about phishing and malicious downloads

These measures help reduce the likelihood of successful cryptojacking attacks.

Investigating suspicious resource usage

Unexpected CPU spikes, persistent background processes, or unusual endpoint behavior may indicate cryptojacking or other malware activity. Security teams need endpoint visibility to determine whether legitimate workloads or malicious software consume system resources.

Hexnode XDR can support these investigations through:

• Visibility into endpoint activity
• Centralized review of security incidents
• Endpoint scans during investigations
• Context gathering from affected devices
• Remote terminal access when appropriate
• Agent update support across managed endpoints

These capabilities help analysts investigate abnormal endpoint activity and identify potential cryptojacking infections.