If a server suddenly feels sluggish for no clear reason, cryptojacking might be the reason why. So what is cryptojacking? It's when someone hijacks your computing resources, without your permission, to mine cryptocurrency for themselves. 

You won't get a ransom note. You won't see a locked screen. The attack just runs quietly in the background, burning through your processing power, your electricity, and eventually your hardware's lifespan, while everything on the surface looks close to normal.

This guide walks through what cryptojacking looks like, how it gets onto your systems, the warning signs to watch for, the real costs it creates, and the steps that actually stop it. None of it requires a security background to follow. It's the same kind of practical, no-jargon walkthrough you'd want from an experienced IT peer, not a vendor trying to sell you something before you've even finished reading.

What Is Cryptojacking?

Cryptojacking is the unauthorized use of someone else's computing resources to mine cryptocurrency. Instead of buying and running their own mining hardware, attackers quietly install mining scripts on devices, servers, or cloud infrastructure they don't own, then keep the proceeds for themselves.

Interest in cryptocurrencies like Bitcoin, Monero, and Ethereum has grown steadily over the past several years, and mining any of them takes real, sustained computing power. Cryptojacking gives attackers that power for free: yours, running quietly in the background while your team assumes everything is normal.

It's rarely destructive in the way ransomware is. There's no data held hostage, no locked files, no ransom note demanding payment. But it's still a genuine security incident, and often a sign that a bigger gap lets the attacker in in the first place.

Cryptojacking vs. Legitimate Cryptomining

Cryptomining itself isn't the problem. It's legitimate when it runs on infrastructure the owner controls and agrees to use for that purpose, whether that's a home rig someone built for the hobby or a company's own servers running the process on purpose.

Cryptojacking is the same computational process, just running without permission on hardware that belongs to someone else. The mining itself is identical either way. The difference is authorization, and who's footing the electricity bill at the end of the month.

How Cryptojacking Attacks Work

Before you can catch cryptojacking, it helps to know how it actually gets onto your systems in the first place. Most attacks fall into one of three categories, depending on where the mining script ends up running and how long it sticks around.

Each type behaves differently, and each calls for a slightly different response. Here's how they break down.

Browser-Based Cryptojacking

This is the lightest-touch version. A compromised website or malicious ad runs mining JavaScript directly in a visitor's browser tab, using the visitor's device to mine for as long as that tab stays open.

It's usually the least damaging variant, since it typically stops the moment the tab closes. Some scripts try to persist through hidden pop-under windows that stay open after the main tab is closed, but browser-based cryptojacking is generally the easiest type to shut down and the least likely to leave anything behind.

Host-Based (Binary) Cryptojacking

This version is more serious. Malware gets installed directly on a device or server, often through a phishing email, an exploited vulnerability, or a malicious download, and it keeps running in the background long after the browser is closed and the initial email is forgotten.

Because it's persistent, host-based cryptojacking tends to do more damage over time: heavier resource use, more wear on hardware, and a longer window for the attacker to maintain access to whatever else that device can reach.

Cloud and Server Cryptojacking

This is the variant that matters most for businesses running their own infrastructure. Attackers exploit misconfigured cloud accounts, exposed APIs, or unpatched servers to spin up mining processes at scale, sometimes across dozens of instances at once without anyone noticing right away.

Because cloud resources scale on demand, this type can also run up a real bill before anyone catches it, since the infrastructure happily provisions more capacity for the attacker exactly as it's designed to. If your team manages its own servers or cloud environment, a Critical Security Controls Assessment can catch the misconfigurations attackers look for before they find them first.

This isn't a hypothetical risk. In 2018, researchers found an exposed, unsecured cloud account belonging to Tesla running cryptomining software after attackers gained access through a misconfigured console. Around the same time, security researchers discovered a Los Angeles Times webpage and a European water utility's operational network both quietly running mining scripts planted by attackers.

None of those organizations set out to get cryptojacked. They just had one gap that went unnoticed long enough.

Common Cryptojacking Attack Vectors

Cryptojacking doesn't need a sophisticated or novel exploit to get started. Most of the time, it rides in on the same gaps that let in other, more familiar kinds of malware, which is good news: if your team already defends against phishing and unpatched software, you're already covering most of the ground cryptojacking needs.

• Phishing emails and malicious links: Still the most common way mining scripts get a foothold, tricking someone into clicking a link or opening an attachment that installs the code quietly in the background.

• Unpatched software and known vulnerabilities: Attackers scan the internet for systems running outdated software, then use a publicly known flaw to slip mining code onto them before a patch gets applied.

• Compromised browser extensions and malicious ads: Legitimate-looking extensions or ad networks that have been hijacked to serve mining scripts to anyone who visits, often without the site owner even knowing.

• Misconfigured cloud or server access: Exposed credentials, open ports, or overly permissive access rules that give attackers a direct line into your infrastructure with none of the usual effort.

Warning Signs: How to Detect Cryptojacking on Your Network

Wondering how to detect cryptojacking before it does real damage? The signs are usually there. They're just easy to write off as “the network's just slow today” instead of something worth investigating.

Performance signals are usually the first clue:

• Unexplained spikes in CPU or GPU usage

• Devices or servers running noticeably hotter than usual, or with fans constantly running at full speed

• A general slowdown across shared systems that doesn't match your team's actual workload

Network and cost signals tell the rest of the story:

• Unfamiliar processes you can't account for

• Outbound connections to unfamiliar IP addresses or known cryptocurrency mining pools

• A jump in power or cooling costs that doesn't line up with anything your team changed on purpose

Any one of these signs on its own might genuinely be nothing. A few of them together, especially on a server that shouldn't be under heavy load in the first place, is worth pulling a thread on.

The Real Cost of Cryptojacking for Businesses

Cryptojacking doesn't steal data, so it's tempting to treat it as a minor nuisance rather than a real incident. The costs add up anyway, just in less obvious places than a typical breach.

Electricity bills climb, since mining runs hardware at sustained high load around the clock instead of the normal, variable pattern most systems see. That same sustained load accelerates wear on the hardware itself, shortening the useful life of servers and devices that weren't built to run flat-out indefinitely.

Legitimate business applications slow down when they're competing with a hidden mining process for the same CPU and memory, which shows up as complaints about a system that “used to be fine.” And perhaps most importantly, if attackers got in once to install a miner, that same gap could have let them access something more valuable than spare processing power. Cryptojacking is often a symptom of a bigger exposure, not just a standalone problem to patch and forget.

How to Prevent Cryptojacking: Best Practices for SMB IT Teams

There's no single fix for cryptojacking. It shows up in browsers, on endpoints, and in cloud environments, so stopping it takes a few layers working together rather than one tool doing all the work by itself.

The best defenses combine everyday habits your team already understands with the right monitoring in place, and none of them require ripping out your existing setup to implement. Here's where to start.

Harden Endpoints and Browsers

Browser extensions and ad blockers that specifically target mining scripts stop a lot of browser-based cryptojacking before it ever starts. Disabling JavaScript on untrusted sites helps too, where it's practical for your team's workflow.

Keep endpoint protection current on every device, not just the ones IT happens to touch most often, since attackers look for whichever device is the weakest link.

Monitor Network Traffic and Resource Usage

Set a baseline for what normal CPU and resource usage actually looks like, so spikes stand out instead of blending into the noise of a busy network. Watch for unusual outbound traffic, especially connections to known mining pool addresses.

Modern network security gear like Fortinet and Sophos firewalls can flag this kind of traffic automatically instead of relying on someone happening to notice a slow server. If your current firewall can't do that, it's worth a look at what's available in the network security category, built for exactly this kind of visibility.

Patch and Update Consistently

Most cryptojacking attacks rely on a known, already-patched vulnerability rather than anything novel or hard to defend against. Keeping firmware, operating systems, and software current closes the door attackers are counting on finding open.

This is one of the simplest, least glamorous defenses on this list, and also one of the most consistently effective.

Train Employees to Spot Phishing and Malicious Links

Since phishing is one of the most common ways mining scripts get in, a team that can spot a suspicious email or link is a real layer of defense, not just a compliance checkbox to tick. Our phishing prevention guide breaks down what to watch for and how to respond if a link turns out to be malicious.

Keep the training practical and specific: what a suspicious link actually looks like, what to do when someone spots one, and who on the team to tell.

Get an Outside Assessment of Your Security Posture

Not every IT team has the bandwidth, or the specialized tooling, to monitor for this kind of activity in-house on top of everything else on their plate, and that's a reasonable place to bring in outside eyes.

An IT Security Assessment looks at your network from the outside in, the same way an attacker would, and flags the gaps before they turn into an actual incident instead of after.

What to Do If You've Been Cryptojacked

If you've already found a mining process running somewhere it shouldn't be, the priority shifts from prevention to containment, and speed matters.

Start by isolating the affected device or server from the rest of the network, so the process can't spread further or keep communicating with whoever's controlling it. Remove the malicious script or process itself, then check whether the same access point was used for anything beyond mining, since cryptojacking access can be a sign of a broader compromise worth investigating fully.

Once the immediate issue is handled, patch whatever let the attacker in to begin with. Otherwise, you're just cleaning up the same problem again next month, on a different server.

It's also worth documenting what happened and how it was caught, even briefly. That record makes the next investigation faster, and it often reveals a pattern, like the same phishing template or the same exposed port, that's worth fixing everywhere at once rather than one server at a time.

Protecting Your Network Starts with Knowing Where You're Exposed

Most cryptojacking incidents don't come from a sophisticated, novel attack that no one could have seen coming. They come from a gap the IT team simply didn't know was there yet: an unpatched server, a phishing email that got through, a cloud account with looser access than anyone realized.

Now that you know what cryptojacking looks like, how it gets in, and what it actually costs, the next step is finding out where your own network stands today. That's a faster conversation with a second set of eyes than it is trying to audit everything alone.

Whether that means tightening up patch schedules, adding traffic monitoring, or bringing in an outside review, the goal is the same: know where you're exposed before someone else finds it for you.

See where your network is exposed. Talk to us about a free IT security assessment.