Fact-checked by Grok 2 weeks ago

Cryptojacking

Cryptojacking is a form of cybercrime in which malicious actors secretly exploit a victim's computing resources—such as CPU, GPU, or cloud infrastructure—to mine cryptocurrencies like Monero or Bitcoin without the owner's knowledge or consent.^[1] This illicit activity often occurs through malware infections, browser-based scripts embedded in websites or advertisements, or vulnerabilities in software and networks, allowing attackers to generate profits at the expense of the victim's device performance and electricity costs.^[2] The phenomenon emerged in the early 2010s alongside the rise of cryptocurrencies, with initial instances reported around 2013 through malware embedded in video games and applications, but it surged in popularity after 2017 due to the introduction of accessible in-browser mining tools like Coinhive, which enabled non-technical attackers to hijack resources via JavaScript on compromised websites.^[3] Common techniques include browser-based cryptojacking, where scripts run temporarily while users visit infected sites (often without installation), and host-based malware, which installs persistent miners through phishing, exploited vulnerabilities (e.g., in routers or servers), or bundled software in legitimate apps like YouTube video loaders or Zoom installers.^[3] Attackers frequently target high-value resources, such as cloud servers (e.g., the TeamTNT botnet compromising tens of thousands of instances across campaigns) or IoT devices, evolving post-2019 to use WebAssembly for efficiency and evasion after Coinhive's shutdown.^[2] Impacts of cryptojacking are multifaceted, causing immediate device slowdowns, overheating, and crashes from resource monopolization, as well as long-term financial burdens from elevated energy bills and potential hardware damage.^[1] On a broader scale, it has affected critical infrastructure, including a 2018 incident where U.S. Department of Defense systems were used to mine 35.4 units of Monero, and it contributes to the broader environmental strain from cryptocurrency mining, which consumes electricity comparable to that of some small nations.^[3] Incidents have proliferated, with a 450% global increase reported in 2019, a fourfold rise in Europe and the U.S. by 2023, and continued growth into 2025—including a 60% rise in evaded attacks in 2024 and over $2.17 billion in illicit cryptocurrency-related crimes by mid-2025—underscoring its persistence as a stealthy threat targeting cloud and AI infrastructure despite detection advancements like machine learning-based monitoring.^[2]^[4]^[5]

Overview

Definition

Cryptojacking refers to the unauthorized use of an individual's or organization's computing resources to mine cryptocurrencies without their knowledge or consent. This cybercrime involves hackers deploying malicious software or scripts that hijack the processing power of devices such as computers, smartphones, servers, and cloud infrastructure to perform cryptocurrency mining operations, generating profit for the attackers while remaining undetected by the victims.^[6]^[7] The primary cryptocurrencies targeted in cryptojacking attacks are privacy-focused ones like Monero (XMR), which is well-suited for mining on standard CPU and GPU hardware due to its ASIC-resistant RandomX algorithm. Zcash (ZEC) uses Equihash, which was designed to be ASIC-resistant but has seen the development of ASICs since 2018, allowing mining on GPUs though less efficiently without specialized equipment. These features, along with their advanced privacy mechanisms—such as ring signatures and stealth addresses in Monero or zk-SNARKs in Zcash—obscure transaction trails, allowing attackers to launder profits more effectively and evade detection by authorities.^[6]^[8]^[7] Key characteristics of cryptojacking include its covert nature, where mining processes run in the background to avoid alerting users through noticeable slowdowns or high resource usage, often achieved via browser-based scripts on compromised websites or malware infections. Unlike legitimate mining, which involves explicit user consent, controlled environments, and reward distribution to participants, cryptojacking deprives victims of any benefits while imposing costs like increased electricity bills and hardware wear without compensation or awareness.^[6]^[9]^[7] As a subtype of broader cybercrime, cryptojacking exemplifies resource hijacking attacks, distinct from data theft or ransomware by focusing on sustained exploitation of computational power rather than direct extortion or information exfiltration, though it may serve as an entry point for more severe threats.^[9]^[7]

History

The origins of cryptojacking trace back to the early proliferation of Bitcoin in 2011, when security researchers first identified malware designed to exploit infected personal computers for cryptocurrency mining. In June 2011, Symantec reported the discovery of the first Bitcoin-specific malware, which primarily stole wallet credentials but highlighted the potential for botnets to covertly mine Bitcoin using victims' hardware resources, marking an early precursor to modern cryptojacking tactics.^[10] This warning came amid Bitcoin's nascent growth, though actual large-scale mining botnets, such as those leveraging GPU capabilities, began appearing later that year, demonstrating the feasibility of unauthorized computational hijacking.^[11] Cryptojacking gained significant traction following the 2017 cryptocurrency boom, particularly with the launch of browser-based mining services that democratized attacks. In September 2017, Coinhive introduced a JavaScript library allowing website owners to embed Monero mining scripts directly in browsers, enabling in-browser cryptojacking without traditional malware installation; this service quickly became dominant, powering over two-thirds of detected attacks by facilitating easy integration for both legitimate and malicious use cases.^[12] The surge aligned with skyrocketing cryptocurrency values, leading to a dramatic increase in incidents as attackers capitalized on the economic incentives.^[13] By the late 2010s, cryptojacking evolved from targeting individual devices to exploiting cloud infrastructure, driven by the scalability and resources of misconfigured servers. Reports from 2018 onward documented a shift, with attackers compromising cloud environments like AWS and Azure to deploy persistent mining operations, as evidenced by a 450% rise in overall cryptojacking events that year.^[13] Coinhive's shutdown in March 2019, prompted by unprofitability and widespread abuse, led to a temporary decline, but alternatives such as Crypto-Loot and WebMiner rapidly filled the void, sustaining browser-based attacks through similar JavaScript mechanisms.^[14] Despite this, overall threats persisted and intensified; SonicWall recorded 332.3 million cryptojacking attempts in the first half of 2023 alone—a 399% year-over-year increase—escalating to 1.06 billion for the full year with an average of approximately 2.9 million daily incidents, representing a 659% rise over 2022.^[15]^[16] Into 2024 and 2025, cryptojacking attacks have continued to grow, with cloud-based incidents projected to increase by about 20% annually through 2025.^[4]

Mechanisms and Types

How Cryptojacking Works

Cryptojacking begins with infection vectors that allow attackers to gain unauthorized access to victims' devices or systems. Common methods include drive-by downloads from compromised websites, where malicious scripts are injected into legitimate pages, and malicious browser extensions that users install unknowingly. Attackers also exploit email attachments containing trojans or leverage software vulnerabilities, such as unpatched plugins like those in content management systems, to deliver payloads.^[6]^[17]^[3] Once infected, attackers execute cryptojacking through two primary methods: browser-based scripts or standalone malware. In browser-based attacks, JavaScript or WebAssembly miners are embedded in web pages, running directly in the victim's browser to perform mining tasks without installing files. For more persistent infections, malware such as trojans deploys dedicated mining software, exemplified by XMRig, which targets Monero cryptocurrency and operates as a high-performance client. These methods hijack computational resources by utilizing CPU and GPU cycles to solve proof-of-work puzzles, such as Monero's RandomX algorithm, which is designed for CPU efficiency and resistance to specialized hardware. The miners connect to remote mining pools over encrypted channels, like HTTPS or WebSocket, to submit work and receive rewards while evading network firewalls.^[17]^[18]^[19]^[3] To maintain operations without alerting users, cryptojackers employ persistence techniques that ensure long-term resource exploitation. Background processes are configured to throttle mining intensity—reducing CPU usage to around 80% during high user activity—to mimic normal system behavior and avoid noticeable slowdowns. Code obfuscation, such as Base64 encoding or binary packing, hides the malicious payloads from antivirus scanners, while techniques like process injection or masquerading as legitimate system services further aid evasion.^[20]^[3]^[17] Profits are extracted by directing the output of mining computations to attacker-controlled cryptocurrency wallets, often through centralized pools that aggregate hashrates from multiple infected devices for proportional reward distribution. Although individual devices yield low returns due to limited processing power, attackers scale operations via botnets comprising thousands of compromised systems, amplifying overall profitability; for instance, privacy-focused coins like Monero facilitate anonymous transfers to evade tracing.^[18]^[3]^[20]

Types of Cryptojacking

Cryptojacking attacks vary based on their delivery mechanisms and targeted environments, allowing attackers to exploit different levels of access and resource availability. These variants include browser-based, malware-based, cloud-based, mobile-specific, and hybrid forms, each presenting unique operational challenges for detection and impact.^[21]^[22] Browser-based cryptojacking, also known as in-browser or drive-by mining, involves injecting malicious JavaScript code into legitimate websites, online advertisements, or browser extensions. This script executes automatically when a user visits the compromised site, hijacking the device's CPU or GPU resources to mine cryptocurrency such as Monero while the page remains open, without requiring any software installation or persistent infection on the victim's device. The mining ceases once the browser tab is closed, making it transient but scalable through widespread web traffic; for instance, attackers may compromise high-traffic sites via vulnerabilities in plugins or content management systems, as seen in a July 2025 campaign affecting over 3,500 websites.^[23] This method prioritizes stealth over longevity, as it avoids antivirus detection by operating solely in memory.^[21]^[22]^[24] Malware-based cryptojacking relies on full device compromise through trojans, ransomware hybrids, or other malicious payloads delivered via phishing emails, drive-by downloads, or infected software. Recent variants as of November 2025 include email-delivered malware that performs covert resource theft for mining upon infection.^[25] Once installed, the malware establishes persistent access, running mining software in the background on endpoints such as personal computers or servers to continuously extract computational resources for cryptocurrency generation. Unlike browser variants, this approach yields higher long-term profits due to uninterrupted operation but increases risks of detection through elevated system resource usage, heat generation, and performance degradation. Targets often include individual users or small networks, with the malware configured to evade scans by mimicking legitimate processes.^[22]^[21]^[24] Cloud-based cryptojacking exploits virtual machines, containers, or servers in cloud platforms like AWS, Azure, or Kubernetes clusters, typically using stolen API credentials obtained through phishing or supply chain compromises. Attackers create or hijack instances with powerful hardware, such as GPU-enabled VMs, to run mining operations that connect to pools like Nanopool, generating significantly higher yields than consumer devices due to scalable, high-performance resources. This variant often involves privilege escalation and lateral movement within the cloud environment, leading to unexpected billing spikes for organizations; for example, Microsoft reported incidents causing over $300,000 in compute fees from such abuse. It differs from endpoint attacks by leveraging shared infrastructure, where detection is complicated by legitimate multi-tenant usage patterns.^[26]^[27]^[24] Mobile cryptojacking targets smartphones and tablets, primarily Android and iOS devices, by embedding hidden mining code within malicious apps, fake utilities, or software development kits (SDKs) integrated into legitimate applications available on app stores. These miners operate in the background, utilizing the device's processor to mine lightweight cryptocurrencies, which can rapidly drain batteries and cause overheating; for example, in a 2018 Kaspersky test on an older Android device, continuous mining deformed the battery after two days. Delivery often occurs through sideloaded apps or compromised store listings, with Android being more vulnerable due to its open ecosystem. This form exploits the ubiquity of mobile devices for broad reach but is limited by hardware constraints compared to desktops or clouds.^[22]^[28] Hybrid forms of cryptojacking combine multiple delivery methods or integrate mining with other malicious activities to enhance efficacy and evasion. For example, attacks may start with browser injection to assess viability before downloading persistent malware, or pair mining with clipboard hijacking in clipper malware that alters cryptocurrency wallet addresses during transactions. A notable 2020 case involved the Lucifer malware, which blended cryptojacking with DDoS capabilities to overload targets while mining. These hybrids, such as those blending 10% code download with 90% browser execution, maximize resource exploitation across vectors but introduce complexity in propagation and control.^[22]^[27]^[29]

Notable Incidents

Pre-2020 Cases

One of the earliest documented cases of unauthorized cryptocurrency mining involved hackers compromising servers of the E-Sports Entertainment Association (ESEA) in 2013, where they installed Bitcoin mining software to exploit the computational resources without user consent.^[30] This incident highlighted the vulnerability of gaming infrastructure to such attacks, though it was later revealed that ESEA's own employee had initiated the mining code, leading to the company being fined $1 million by the New Jersey Attorney General for violating consumer protection laws.^[31] In a related early enforcement action, German police arrested two individuals in December 2013 for operating a botnet that hacked into computer networks to mine over €700,000 (approximately $950,000) worth of Bitcoin, seizing the illicitly generated funds and marking one of the first major law enforcement interventions against such operations.^[32] Between late 2013 and early 2014, a malware campaign targeted Yahoo Europe's advertising network, infecting an estimated 2 million computers primarily in Germany and other European countries by exploiting vulnerabilities in Java-based ads.^[33] The malware hijacked users' processors to mine Bitcoin undetected for several months, siphoning resources from victims' devices while they browsed Yahoo sites, and was only discovered after security firm Fox-IT alerted authorities to unusual network traffic.^[34] This browser-based attack demonstrated the ease of distributing mining scripts through legitimate ad platforms, affecting a broad user base and prompting Yahoo to enhance its ad verification processes.^[35] In 2018, malicious advertisements on YouTube exploited Google's DoubleClick platform to distribute Coinhive mining scripts, impacting millions of viewers worldwide by covertly using their devices' CPU power to mine Monero cryptocurrency.^[36] Security researchers at Trend Micro identified the ads, which masqueraded as legitimate video promotions and ran the mining code in users' browsers without detection, leading Google to suspend the offending ad accounts and block thousands of malicious domains.^[37] The incident underscored the risks of supply chain attacks in video streaming services, where brief exposure to an ad could initiate mining on unsuspecting devices. The widespread abuse of Coinhive between 2018 and 2019 involved hackers injecting its JavaScript miner into compromised websites, including high-profile breaches at Showtime, where the code was embedded to mine Monero using visitors' resources, and the Atlantic Council, whose site was similarly tampered with to facilitate unauthorized mining.^[38] These attacks proliferated due to Coinhive's ease of integration, affecting thousands of sites and prompting affected organizations to audit their web infrastructure; the service's shutdown in March 2019 was driven by declining Monero profitability and reputational damage from its criminal misuse, though forks like CryptoLoot emerged shortly after.^[39] In 2018, cryptojacking malware using Coinhive was discovered on U.S. Department of Defense servers, mining approximately 35.4 units of Monero over the course of the infection.^[3] Early botnets like Linux.Encoder, which emerged in 2017, targeted vulnerable Linux servers—particularly web and database hosts—by encrypting files and demanding ransom while also deploying persistent mining modules to generate cryptocurrency revenue. These server-focused operations scaled by exploiting unpatched software, amassing significant hashing power across infected systems, and posed unique challenges for law enforcement due to the anonymity provided by cryptocurrency transactions and the distributed nature of botnets, often hindering attribution and asset recovery efforts.^[40]

2020–2025 Developments

In 2021, zero-day vulnerabilities in Microsoft Exchange servers were exploited by threat actors, including the Chinese state-sponsored group Hafnium, to gain unauthorized access to on-premises systems.^[41] Following initial espionage activities, opportunistic attackers such as the Lemon Duck botnet leveraged these flaws to deploy cryptocurrency miners, enabling widespread cryptojacking on compromised servers.^[42] This incident highlighted the vulnerabilities' role in facilitating resource-intensive mining operations across thousands of organizations globally.^[43] The TeamTNT botnet, active since 2020, targeted cloud and Kubernetes environments, infecting over 850,000 servers for Monero mining through exploited vulnerabilities in Docker APIs and other misconfigurations.^[2] In 2023, cryptojacking attacks experienced a dramatic resurgence, with SonicWall reporting a 659% year-over-year increase in incidents for the full year, totaling 1.06 billion attacks, including 332.3 million in the first half of the year alone (a 399% rise).^[15]^[44] This surge underscored the tactic's appeal as a low-effort, high-volume method for illicit mining, often targeting cloud infrastructure and unpatched systems. In 2024, a notable legal case emerged from Nebraska involving Charles O. Parks III, who operated a cryptojacking scheme under the guise of an educational platform.^[45] Parks defrauded cloud providers of approximately $3.5 million in computing resources to mine cryptocurrency, leading to charges of wire fraud, money laundering, and unlawful monetary transactions.^[46] He pleaded guilty in December 2024 and was sentenced in August 2025 to one year and one day in prison, marking a significant prosecution in the evolving landscape of cryptojacking accountability.^[46] In July 2025, a broad-scale JavaScript-based cryptojacking wave compromised over 3,500 websites worldwide, injecting obfuscated miners that exploited browser resources without user detection.^[47] Attackers used advanced evasion techniques, such as WebSocket communications, to maintain stealthy mining operations across diverse site hosts.^[48] In November 2025, threat actors exploited a critical vulnerability in the Ray open-source AI framework to deploy a self-replicating cryptojacking botnet, targeting exposed clusters worldwide for unauthorized cryptocurrency mining.^[49] Overall, cryptojacking incidents rose by 63% in 2025 through mid-year, reflecting a continued shift toward more sophisticated tactics.^[50] A notable trend involved AI-assisted evasion, with approximately 35% of related botnet operations incorporating machine learning to adapt payloads and avoid detection in real-time.^[51]

Security Measures

Detection Techniques

Detecting cryptojacking requires monitoring for specific indicators of unauthorized mining activity, which can manifest through resource consumption patterns and system behaviors. Behavioral indicators often include unusual spikes in CPU or GPU usage, even during periods of low user activity, leading to noticeable system slowdowns, overheating, or reduced performance.^[3]^[52] Additionally, increased electricity consumption without corresponding workload increases can signal persistent mining operations, as the intensive computational demands of algorithms like those for Monero persist in the background.^[53] These signs are particularly evident in malware-based cryptojacking, where infected hosts exhibit sustained high-load tasks.^[3] Network monitoring provides another key avenue for identification by scrutinizing outbound traffic for connections to known cryptocurrency mining pools. Common indicators include persistent low-rate traffic to suspicious IP addresses or domains associated with pools, often over specific ports such as 3333 or 4444, which are frequently used by mining software like XMRig.^[54] Tools like Crypto-Aegis leverage machine learning to analyze encrypted network traffic patterns, achieving high detection rates by identifying subtle anomalies in packet sizes, inter-arrival times, and flow characteristics without decrypting payloads.^[55] This approach has demonstrated over 95% accuracy in distinguishing mining traffic from legitimate activities in real-world scenarios.^[56] Endpoint detection tools focus on scanning for known mining binaries and scripts directly on devices. Antivirus solutions commonly incorporate signatures for prevalent miners like XMRig, which is an open-source CPU miner frequently repurposed for illicit activities, allowing real-time identification and quarantine of infected processes.^[57] For browser-based attacks, extensions such as No Coin employ domain blacklisting to detect and block JavaScript miners by intercepting requests to known malicious scripts, providing lightweight protection against in-browser cryptojacking, though users should consider more actively maintained alternatives like MinerBlock as of 2025.^[58] Log analysis involves examining system and application logs for anomalous patterns indicative of mining. Indicators include the presence of unexpected processes consuming excessive resources or the execution of WebAssembly (WASM) modules in browsers, which are often used to obfuscate and run efficient mining code.^[59] Security Information and Event Management (SIEM) systems can correlate these logs with rules to alert on persistent high-compute tasks, such as repeated system calls for cryptographic hashing, enabling proactive investigation.^[60] Advanced techniques enhance detection through heuristic and behavioral analytics tailored to evasive tactics. Heuristic analysis targets obfuscated JavaScript by profiling code structures and execution flows for mining-specific patterns, such as intensive loop iterations for proof-of-work computations, with machine learning models like random forests achieving up to 98% accuracy.^[61] Integration with Endpoint Detection and Response (EDR) platforms allows for real-time anomaly detection by combining host telemetry, such as hardware performance counters and syscall monitoring, to flag deviations from baseline behavior in both in-browser and host-based attacks.^[3] Recent advancements as of 2025 include deep learning-based frameworks for detecting cryptojacking in cloud containerized environments, offering efficient detection with minimal overhead.^[62] AI-based dashboards like CryptoGuard provide user-friendly interfaces for real-time monitoring and mitigation.^[63] Additionally, interpretable machine learning approaches using Local Interpretable Model-agnostic Explanations (LIME) balance accuracy and explainability in detection models.^[64] According to McAfee's 2024 Threat Report, cryptojacking attacks evading detection increased by 60% in the past year, highlighting the need for evolving techniques.^[4]

Prevention Strategies

Preventing cryptojacking requires proactive measures to address vulnerabilities, secure networks, and promote safe user behaviors, thereby blocking unauthorized access to computing resources before exploitation occurs.^[1] Organizations and individuals can implement layered defenses focusing on patching, traffic controls, and policy enforcement to minimize entry points for malicious scripts or malware.^[27] Regular software updates and patching form a foundational strategy to eliminate injection points exploited by cryptojackers, such as outdated browsers or deprecated plugins like Adobe Flash, which historically enabled drive-by downloads.^[7] For instance, keeping operating systems, web browsers, and applications current prevents attackers from leveraging known vulnerabilities to inject mining code.^[1] Automated patch management tools prioritize updates for high-risk assets, ensuring timely remediation without manual intervention.^[27] Network controls effectively restrict the delivery and operation of cryptojacking payloads by filtering suspicious traffic and content. Firewalls configured to block outbound connections to known mining pool IP addresses or domains, such as those associated with Monero pools, prevent resource hijacking at the perimeter.^[1] Ad blockers, including extensions like uBlock Origin, further mitigate risks by intercepting embedded mining scripts in advertisements or compromised websites, as these tools incorporate filters specifically designed to detect and halt cryptomining attempts.^[65] Web application firewalls provide an additional layer by analyzing traffic for anomalous patterns indicative of script injection.^[22] User education empowers individuals to avoid common vectors for cryptojacking, such as phishing emails or malicious downloads. Training programs should emphasize verifying sources before downloading files or clicking links, as well as using secure connections like VPNs on public Wi-Fi to prevent man-in-the-middle attacks that could facilitate payload delivery.^[22] Regularly monitoring system resource usage through built-in tools like Windows Task Manager or macOS Activity Monitor helps users identify unusual CPU spikes early, allowing for immediate investigation without relying on advanced detection.^[7] For organizations, implementing robust policies through endpoint protection platforms (EPP) with behavior-based blocking is essential to safeguard devices and cloud environments. These platforms monitor for unauthorized processes and halt them proactively, integrating seamlessly with identity and access management (IAM) systems to limit credential abuse.^[7] In cloud settings, IAM controls such as multi-factor authentication (MFA), privileged identity management, and conditional access policies restrict over-privileged accounts, preventing attackers from spinning up unauthorized virtual machines for mining.^[26] Emerging technologies enhance prevention by isolating potential threats and enforcing strict verification. Browser sandboxing improvements, such as those in modern engines like Chromium, confine JavaScript execution to isolated environments, limiting the spread of mining code across tabs or sessions.^[66] Zero-trust models complement this by requiring continuous authentication and granular access controls, ensuring that even compromised credentials cannot escalate to resource-intensive activities like cryptomining in cloud or endpoint infrastructures.^[67] As of 2025, enhanced focus on container security and AI-driven anomaly detection in cloud environments addresses rising threats in containerized setups.^[62]

Impacts and Responses

Economic and Technical Impacts

Cryptojacking imposes significant resource drain on affected devices by commandeering central processing units (CPUs) and graphics processing units (GPUs) for unauthorized cryptocurrency mining, leading to reduced performance and increased hardware stress. Victims often experience noticeable slowdowns in computing speed, as the malware prioritizes mining tasks over legitimate operations, resulting in sluggish applications and diminished productivity.^[22]^[27] Additionally, the intensive computational demands cause overheating of hardware components, such as GPUs and batteries, which can accelerate wear and potentially shorten device lifespan or lead to permanent damage from prolonged high temperatures.^[22]^[68] This resource hijacking also elevates energy consumption, manifesting as higher electricity bills for individuals and organizations, with global estimates from a 2018 study indicating a daily economic cost of approximately $59,000 USD attributable to widespread cryptojacking activity affecting millions of users monthly.^[69]^[70] Economically, cryptojacking yields low returns per individual victim but achieves substantial scale through mass infections, enabling attackers to amass illicit mining revenue in the millions annually. For instance, in a notable cloud-based cryptojacking scheme, a perpetrator in Nebraska defrauded providers of over $3.5 million in computing resources to mine cryptocurrencies between 2021 and 2024, highlighting how attackers exploit scalable infrastructure for profit while imposing unpaid costs on service hosts.^[71] Despite the per-incident yield being modest—often mere cents per device—the cumulative effect from infecting vast networks, such as websites or enterprise systems, was estimated to generate about $21.5 million in annual illicit revenue for cybercriminals as of 2018.^[69] These losses extend beyond direct theft, encompassing indirect expenses like elevated utility payments and the need for remediation efforts to restore compromised systems. As of 2025, cloud-based cryptojacking activity has risen by approximately 20%, contributing to ongoing economic burdens without precise updated global figures available.^[72] On the technical front, cryptojacking induces system instability by overloading resources, frequently causing application crashes, unresponsiveness, and full device failures due to excessive CPU utilization.^[21]^[73] This overload disrupts normal operations, creating opportunity costs such as delayed business processes and reduced employee efficiency in affected environments.^[74] In enterprise settings, the persistent background mining can exacerbate network latency and server downtime, compounding technical vulnerabilities and necessitating resource-intensive diagnostics.^[75] The broader ecosystem faces indirect pressures from cryptojacking's distributed energy demands, which contribute to heightened overall electricity usage without corresponding infrastructure investments, though the impact remains less pronounced than large-scale legitimate mining operations. For victims, individuals primarily endure personal financial burdens from utility spikes and device degradation, while enterprises grapple with recovery costs for system audits and hardware replacements, often in the range of thousands per incident.^[76]^[77]

Legal and Ethical Considerations

Cryptojacking is legally classified in the United States primarily under the Computer Fraud and Abuse Act (CFAA), which prohibits unauthorized access to computer systems, with penalties ranging from one to 20 years imprisonment depending on the severity of the violation.^[78] It is also frequently prosecuted as wire fraud, carrying a maximum sentence of 20 years, due to the deceptive transmission of data across state lines to hijack computing resources.^[78] Internationally, enforcement faces challenges from cross-border mining pools, which facilitate the laundering of illicitly mined cryptocurrency and complicate attribution across jurisdictions.^[79] Notable prosecutions include the 2025 sentencing of Charles O. Parks III, a Nebraska-based cryptocurrency influencer known as "CP3O," who was convicted of wire fraud, money laundering, and unlawful monetary transactions for orchestrating a cryptojacking scheme that defrauded cloud computing providers of over $3.5 million in resources.^[46] Parks received a one-year prison sentence after pleading guilty to using misrepresented educational platforms to mine cryptocurrency on hijacked cloud infrastructure.^[46] Regulatory responses have included calls for enhanced know-your-customer (KYC) requirements on cryptocurrency mining pools to better trace and disrupt illicit activities, as these platforms are often exploited to obscure the origins of cryptojacked funds.^[79] In the European Union, the General Data Protection Regulation (GDPR) primarily addresses personal data breaches. Ethically, cryptojacking raises profound concerns over consent, as attackers exploit users' devices without permission, depriving individuals and organizations of control over their computational resources and often causing undetected performance degradation.^[21] This lack of consent exacerbates equity issues, disproportionately affecting under-resourced users in developing regions or small entities unable to afford robust defenses, thereby widening digital divides.^[24] Furthermore, the environmental toll is significant, with cryptojacking contributing to unnecessary energy consumption—equivalent to substantial electricity waste—that intensifies global sustainability challenges amid cryptocurrency mining's already high carbon footprint.^[50]^[80] Looking ahead, the 63% rise in cryptojacking incidents reported in 2025 underscores the urgency for targeted legislation, with experts advocating for specialized anti-cryptojacking laws to address evolving tactics beyond existing fraud statutes.^[50] Such measures could include mandatory reporting for anomalous mining activity and international cooperation to regulate decentralized pools, potentially mitigating the trend as enforcement priorities shift toward cryptocurrency-related crimes.^[81]

References

[1]
Defending Against Illicit Cryptocurrency Mining Activity - CISA
Feb 1, 2021 · What is cryptojacking? Solving cryptographic calculations to mine cryptocurrency requires a massive amount of processing power. Cryptojacking ...
[2]
Cryptojacking: A Comprehensive Review of Attack Techniques ...
Jan 31, 2025 · Cryptojacking may be defined as a cybercrime whereby a computer or its computer facilities of the victim are used without his consent for mining ...
[3]
[PDF] SoK: Cryptojacking Malware - Cyber-Physical Systems Security Lab |
Jun 29, 2023 · Cryptomining and cryptojacking have recently become popular topics among researchers after the price surge of cryptocurrencies and the release ...
[4]
What is Cryptojacking & How does it work? - Kaspersky
Cryptojacking is where cybercriminals secretly use a victim's computing power to generate cryptocurrency. Learn the risks & how to protect yourself.
[5]
What is Cryptojacking? Identifiers & Prevention Tips | CrowdStrike
Oct 4, 2022 · Cryptojacking is the unauthorized use of a person's or organization's computing resources to mine cryptocurrency.
[6]
How to protect your business from the increasing risks of cryptojacking
Oct 15, 2019 · The most popular cryptocurrencies to mine include lesser-known ones like Monero and Zcash, because they make it even harder to track illegal ...Missing: preferred | Show results with:preferred
[7]
What Is Cryptojacking? Definition & Detection | Proofpoint US
Cryptojacking is the process of tricking users into using their computers and mobile devices to generate cryptocurrency for an attacker.Cryptojacking Definition · How Does Cryptojacking Work?
[8]
New Malware Steals Your Bitcoin - WIRED
Jun 16, 2011 · Hacker types have been sniffing around Bitcoin since at least April, when a program called Stealthcoin debuted that's tailor-made for turning a ...
[9]
More Bitcoin malware: this one uses your GPU for mining
Aug 17, 2011 · In a report issued last week, Symantec researchers described a Trojan that uses the user's computer to mine Bitcoins on behalf of the intruder.
[10]
Unauthorized Coin Mining in the Browser - Palo Alto Networks Unit 42
Oct 17, 2017 · Coinhive, one of the more popular browser-mining services out there offers site owners a piece of JavaScript for easy integration.
[11]
Cryptojacking Rises 450 Percent as Cybercriminals Pivot From ... - IBM
Cryptojacking surged by 450 percent over the course of 2018, according to the newly released “IBM X-Force Threat Intelligence Index 2019.”
[12]
The End of Coinhive; The end of cryptojacking? - Avast Blog
Mar 8, 2019 · On March 8, 2019 Coinhive, the service that enables websites around the world to use browser CPUs to mine Monero, will shut down.The End Of Coinhive; The End... · Going From Mining Their Own... · Cryptojacking In The Gray...
[13]
Cryptojacking Continues Crushing Records - SonicWall
Aug 16, 2023 · In all, cryptojacking volume in the first half of 2023 reached 332.3 million, an increase of 399% year-to-date. Four months out of six set ...
[14]
What Is Cryptojacking? - Palo Alto Networks
Cryptojacking is the unauthorized use of computing resources to mine cryptocurrency. Often delivered via browser scripts, infected software, or compromised ...
[15]
Cryptominers' Anatomy: Cryptomining Internals - Akamai
Feb 6, 2025 · More privacy-focused cryptocurrencies, such as Monero or Zcash, take this further by implementing advanced cryptographic techniques like ring ...
[16]
Compute Hijacking, Sub-technique T1496.001 - MITRE ATT&CK®
Sep 25, 2024 · Additionally, some cryptocurrency mining malware identify then kill off processes for competing malware to ensure it's not competing for ...
[17]
Cryptojacking – What is it, and how does it work? - Malwarebytes
Cryptojacking is a form of malware that hides on your device and steals its computing resources in order to mine for valuable online currencies like Bitcoin.What Are Cryptocurrencies? · How Do People Use... · How Does Cryptojacking Work?Missing: GPU RandomX pools<|separator|>
[18]
What is Cryptojacking? | IBM
Cryptojacking is a type of cyberattack in which cybercriminals hijack the computing resources of victims' devices to mine cryptocurrency without permission.Missing: RandomX traffic
[19]
What Is Cryptojacking | Types, Detection & Prevention Tips - Imperva
Cryptojacking is a threat that implants itself within a mobile device or computer and then employs measures to mine cryptocurrency.
[20]
What is Cryptojacking? Types & Real World Examples - SentinelOne
Jul 22, 2025 · Cryptojacking is a cyber attack that steals computing resources to mine cryptocurrency without authorization.Missing: proof- RandomX
[21]
Cryptojacking: Understanding and defending against cloud compute ...
Jul 25, 2023 · Cryptojacking – a type of cyberattack that uses computing power to mine cryptocurrency – takes the form of cloud compute resource abuse.Missing: RandomX traffic
[22]
What Is Cryptojacking? How It Works & Tips to Prevent It | Wiz
Mar 15, 2025 · Main takeaways from Cryptojacking: · Cryptojacking attacks hijack device or virtual machine processing power to mine cryptocurrency, consuming ...
[23]
Crypto-stealing iOS, Android malware found on App Store, Google ...
Feb 5, 2025 · iOS and Android apps on Apple's and Google's app stores contain a malicious SDK that turns them into crypto-stealing malware.
[24]
Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting ...
Jun 24, 2020 · Lucifer is a new hybrid of cryptojacking and DDoS malware variant that leverages old vulnerabilities to spread and perform malicious activities ...
[25]
Gaming Company Fined $1M for Turning Customers Into ... - WIRED
Nov 19, 2013 · A gaming software company has been slapped with a $1 million fine after secretly adding bitcoin mining software to a product update earlier this year.Missing: German police
[26]
illegally mine for bitcoins - State of New Jersey
Nov 19, 2013 · ... E-Sports bitcoin mining code. E-Sports apparently terminated use of the bitcoin mining code in May 2013 after an E-Sports subscriber discovered ...Missing: German police seizure
[27]
German Police Detain 'Bitcoin Mining Hackers' - CoinDesk
German police have detained two people suspected of hacking into computer networks and using them to mine over €700,000 worth of bitcoins.Missing: ESEA | Show results with:ESEA
[28]
Yahoo malware enslaves PCs to Bitcoin mining - BBC News
Jan 8, 2014 · Adverts on Yahoo's homepage were infected with malware designed to mine the Bitcoin virtual currency, according to security experts.
[29]
Yahoo malware turned European computers into bitcoin slaves
Jan 8, 2014 · Search firm remains silent on how its ad servers infected thousands of European computers. By Alex Hern.
[30]
Malicious advertisements served via Yahoo - Fox-IT Blog
Jan 3, 2014 · Detection of the infection Fox-IT operates the shared Security Operations Center service ProtACT. This service monitors the networks of our ...
[31]
YouTube caught out by coin-mining adverts - BBC
Jan 29, 2018 · The ads used visitors' computers to generate valuable crypto-coins for a cyber-scam.
[32]
YouTube ads have been secretly mining cryptocurrency | Mashable
YouTube ads are the latest ground zero for nefarious crypto mining. Cryptojackers figured out how to turn Google's DoubleClick ad service into a platform for ...
[33]
Cryptocurrency Mining Malware Landscape - Secureworks
Mar 7, 2018 · CoinHive code inserted into CBS's Showtime website. (Source: The Register). Threat actors exploit any opportunity to generate revenue, and ...
[34]
Crypto Mining Service Coinhive to Call it Quits - Krebs on Security
Feb 27, 2019 · In the announcement about its pending closure, Coinhive said the mining service would cease to operate on March 8, 2019, but that users ...
[35]
Linux.Encoder - Wikipedia
Linux.Encoder (also known as ELF/Filecoder.A and Trojan.Linux.Ransom.A) is considered to be the first ransomware trojan targeting computers running Linux.Missing: 2017 cryptojacking
[36]
Cryptocurrencies—A Forensic Challenge or Opportunity for Law ...
Law enforcement considers the aforementioned cryptocurrencies highly disruptive due to their enhanced anonymity, which makes them an effective weapon for ...<|control11|><|separator|>
[37]
HAFNIUM targeting Exchange Servers with 0-day exploits - Microsoft
Mar 2, 2021 · Microsoft has detected multiple 0-day exploits being used to attack on-premises versions of Microsoft Exchange Server in limited and targeted attacks.Missing: cryptojacking | Show results with:cryptojacking
[38]
Analyzing attacks taking advantage of the Exchange Server ...
Mar 25, 2021 · We are sharing intelligence about what some attackers did after exploiting the vulnerable servers, ranging from ransomware to data exfiltration and deployment.Lemon Duck Botnet · Pydomer Ransomware · Advanced Hunting
[39]
Unpatched Microsoft Exchange Servers hit with cryptojacking
Apr 14, 2021 · Hackers are hitting vulnerable Microsoft Exchange Servers with a Monero cryptominer, according to new Sophos research.Missing: via | Show results with:via
[40]
2023 SonicWall Cyber Threat Report: Shifting Front Lines
Feb 21, 2023 · Cryptojacking – Use of cryptojacking as a 'low and slow' approach continued to surge, rising 43% globally, which is the most SonicWall Capture ...Missing: 659% 332.3
[41]
Nebraska Man Pleads Guilty in Multi-Million Dollar “Cryptojacking ...
Dec 5, 2024 · Charles O. Parks III, also known as “CP3O,” pleaded guilty to wire fraud for operating a large-scale illegal “cryptojacking” operation.
[42]
Crypto Influencer Sentenced to Prison for Multi-Million Dollar ...
Aug 15, 2025 · “Cryptojacking,” also referred to as malicious cryptomining, is the unauthorized use or hijacking of another party's resources, such as ...
[43]
New MassJacker Malware Targets Piracy Users, Hijacking ...
Mar 14, 2025 · MassJacker clipper malware hijacks cryptocurrency transactions, targeting piracy users via Pesktop[.]com, with attackers linked to 778K+ ...Missing: hybrid | Show results with:hybrid
[44]
MassJacker malware uses 778,000 wallets to steal cryptocurrency
Mar 11, 2025 · A newly discovered clipboard hijacking operation dubbed 'MassJacker' uses at least 778531 cryptocurrency wallet addresses to steal digital ...
[45]
Captain MassJacker Sparrow: Uncovering the Malware's Buried ...
Mar 10, 2025 · Cryptojacking malware—a type of malware that tries to steal cryptocurrencies from users on infected machines.
[46]
3,500 Websites Hijacked to Secretly Mine Crypto Using Stealth ...
Jul 21, 2025 · A new attack campaign has compromised more than 3,500 websites worldwide with JavaScript cryptocurrency miners, marking the return of ...
[47]
Thousands of websites subjected to cryptojacking campaign
Jul 22, 2025 · Over 3500 websites around the world have been infected with JavaScript cryptocurrency mining malware as part of a new cryptojacking campaign ...
[48]
Cryptojacking: Why Ignoring It Could Cost You More than You Think
Sep 10, 2025 · Parks is far from alone in his exploits: In just the first quarter of 2023, cryptojacking attacks stood at an eye-watering 332.3 million. That's ...
[49]
AI Cyber Attacks Statistics 2025: Attacks, Deepfakes, Ransomware
Oct 7, 2025 · In 2025, 35% of botnet operations incorporated machine learning algorithms to evade detection and adapt in real-time. Healthcare, a critical ...<|control11|><|separator|>
[50]
What Is Cryptojacking & How Does It Work? Examples, Signs & More
Cryptojacking is a type of cyberattack in which a cybercriminal hijacks a computer or mobile device and uses its processing power to mine cryptocurrency ...Missing: extraction | Show results with:extraction
[51]
Cryptojacking: How to Detect Crypto Mining Malware - Cybernews
Sep 2, 2025 · Some indicators are slower performance, overheating, high battery consumption, high CPU or GPU and sudden fluctuations of network usage.
[52]
[PDF] THE ILLICIT CRYPTOCURRENCY MINING THREAT
This report lays out the threat, its potential impacts, and the best practices organizations can employ to counter it. Page 2. 2. The Cyber Threat Alliance (CTA) ...
[53]
a Machine Learning Approach for Cryptojacking Detection - arXiv
Oct 21, 2019 · In this paper, we propose a network-based approach to detect and identify crypto-clients activities by solely relying on the network traffic, even when ...
[54]
Cryptomining makes noise: Detecting cryptojacking via Machine ...
Apr 1, 2021 · This attack mainly consists on the unauthorized mining of cryptocurrencies allowing malicious parties to steal resources in terms of CPU, GPU, ...
[55]
XMRig Malware - Check Point Software
XMRig is open-source software designed for mining cryptocurrencies like Monero or Bitcoin. However, it is also commonly abused by cybercriminals in their ...Missing: signature | Show results with:signature
[56]
keraf/NoCoin: No Coin is a tiny browser extension aiming to ... - GitHub
Sep 10, 2020 · The extension is simply blocking a list of blacklisted domains in blacklist.txt. Clicking on the icon will display you a button to pause/unpause No Coin.
[57]
An Approach with Autoencoders and Deep Dense Neural Networks
This paper proposes an ML-based solution that employs a holistic view of cryptojacking, concentrating its effort on two major attack surfaces: the network, ...3. Cryptomining... · 5. Proposed Framework · 5.1. Data Collection<|control11|><|separator|>
[58]
Cryptojacking demystified: Part 2 - Attack detection - ManageEngine
May 18, 2022 · With a SIEM solution, you can set correlation rules to alert you when a device shows signs of being cryptojacked, and confirm this by ...Missing: WebAssembly | Show results with:WebAssembly
[59]
On Detecting Cryptojacking on Websites: Revisiting the Use of ... - NIH
Nov 27, 2022 · Cryptojacking or illegal mining is a form of malware that hides in the victim's computer and takes the computational resources to extract ...
[60]
[PDF] A Framework for Detecting and Analyzing Web-based ...
Aug 27, 2018 · Ad blockers such as uBlock Origin [9] already implemented basic cryptojacking mitigations and also dedicated browser extensions such as ...Missing: prevent | Show results with:prevent
[61]
What Is Web Browser Isolation? - Proofpoint
Browser isolation separates web browsing from local networks by operating in a secure, virtualized environment, preventing browser-based code from accessing ...<|control11|><|separator|>
[62]
Cryptojacking: Impact, Attack Examples, and Defensive Measures
Jan 19, 2023 · Cryptojacking Attacks in Cloud Native Hackers compromise cloud accounts to create distributed cryptomining workloads—they compromise vulnerable ...
[63]
Mining in the shadows: cryptojacking exposed | UBS Germany
Oct 29, 2025 · Signs of a silent attack · Performance issues such as system slowdown, freezing, crashing, or overheating · High CPU/GPU8 usage with minimal ...Missing: indicators | Show results with:indicators
[64]
A Systematical Study about Cryptojacking in the Real World
Aug 31, 2025 · Alarmingly, Hong et al. [48] estimated that cryptojackers could generate approximately 59,000 USD in profits.
[65]
Cryptojacking could be costing your business and the Earth
Jun 7, 2023 · Cryptojacking is a damaging and wasteful threat leading to unnecessary greenhouse gas emissions and high electricity bills for businesses.
[66]
Nebraska Man Indicted for Multi-Million Dollar "Cryptojacking" Scheme
Apr 15, 2024 · Defendant Allegedly Stole More Than $3.5 Million in Cloud Computing Services In Order to Mine Cryptocurrency. Today, an indictment was ...Missing: economic loss
[67]
What is Cryptojacking? Crypto Mining Hijacking Examples | Darktrace
Cryptojacking is the unauthorized use of a computer or device's processing power to mine cryptocurrencies, often without the owner's consent or knowledge.
[68]
Who's using your computers? Cryptojacking degrades network ...
Oct 22, 2021 · Cryptojacking rarely results in any serious damage to the victim, beyond impaired performance, increased electric bills, and higher IT overhead ...
[69]
The Year Cryptojacking Ate the Web - WIRED
Dec 24, 2018 · Malicious mining malware has lurked for a while, but attackers didn't realize its full potential until a group called Coinhive created a simple ...
[70]
How to Prevent Cryptojacking - Threat Intelligence - SentinelOne
Jun 1, 2025 · Hybrid cryptojacking attacks might combine both these two strategies and increase the efficacy of browser-based cryptojacking attacks. Some ...
[71]
What is Cryptojacking & How does it work?
### Summary of How Cryptojacking Works
[72]
Can you go to prison for unauthorized crypto mining
Rating 5.0 (685) Oct 8, 2025 · The charges carry serious prison time – wire fraud alone is 20 years maximum, CFAA violations range from one year to 20 years depending on what ...
[73]
Cryptocurrency Mining Pools and Crypto Money Laundering
Jun 15, 2023 · Learn how cybercriminals can money launder cryptocurrency via mining pools, with two real world examples involving ransomware and scams.Missing: cryptojacking | Show results with:cryptojacking
[74]
The Environmental Impacts of Cryptomining - Earthjustice
Sep 23, 2022 · Cryptocurrency mining is an extremely energy-intensive process that threatens the ability of governments across the globe to reduce our dependence on climate- ...Missing: ethical equity waste
[75]
Crypto Enforcement Trends 2025: Navigating Deregulation, Fraud ...
Nov 4, 2025 · The cryptocurrency sector continues to evolve rapidly, marked by significant regulatory and enforcement developments in 2025.