What Is Cryptojacking?

Cryptojacking is the unauthorised use of someone else's computing resources to mine cryptocurrency. The direct harm is theft of capacity and electricity rather than data loss, which makes it easy to treat as a low priority.

That is usually a mistake. The mining is the least important thing about it, because the access required to install it would support considerably worse.

Where it appears

Cloud environments are the highest-value target, because capacity is elastic and billed to someone else. A compromised cloud credential can generate very large charges quickly, and auto-scaling amplifies it.

Also: servers, which run continuously and are less closely watched than workstations; containers and build pipelines, where resources are provisioned automatically; and connected devices, which are individually weak and numerous.

The cloud cost exposure is the real risk

Unlike on-premises mining, which wastes capacity you already own, cloud mining creates direct liability. Incidents have produced bills in the hundreds of thousands within days, and the usual discovery mechanism is the bill.

Billing anomaly alerting is therefore a security control. So are spending limits, restrictions on which instance types and regions may be used, and alerting on resource creation outside normal patterns.

Why it is a warning rather than a nuisance

The access needed to run mining software is the access needed to steal data, deploy ransomware or establish persistent control. Mining is simply the most immediately monetisable use of it.

The same compromised credential or unpatched service may also have been sold to someone with different intentions. Treating a mining finding as a full compromise investigation rather than a cleanup task is the appropriate response.

Detection is comparatively straightforward

Sustained high processor utilisation with no business explanation. Connections to mining pool infrastructure, which is well documented and blockable. Unexpected processes consuming resources.

In cloud: instances created outside normal processes, unusual instance types, activity in regions you do not use, and billing that departs from the established pattern.

The browser-based variant

Script running in a page mines while the tab is open, which affects visitors rather than the site operator — unless it is your site that was compromised to host it.

It has declined substantially with the end of the services that made it easy, and content blocking addresses most of what remains. Monitoring your own pages for unexpected third-party script is the part that protects your visitors.

Build pipelines and free compute

Continuous integration runners, free tier accounts and trial subscriptions are heavily abused for mining, because they provide capacity with weak identity requirements. Where a public repository allows contributors to trigger builds, that build capacity is effectively open.

Restricting which contributors can run pipelines, limiting runner resources and runtime, and alerting on jobs that exceed expected duration are the controls. It also matters because a pipeline holds deployment credentials, which makes abuse of it more than a capacity problem.

Where to start

Set up billing anomaly alerting on your cloud accounts with a threshold that would catch a sudden increase within a day. It is the detection that limits the financial exposure.

See network traffic analysis. GuardsArm delivers cloud security assessment.