Cryptojacking Explained: How to Stop It in Your Business

Cryptojacking is the quiet cousin of ransomware — an attack that runs silently on a compromised computer, mining cryptocurrency for the attacker using the victim’s electricity and CPU cycles. There is no ransom note, no encrypted files, no obvious symptoms other than slower systems and higher power bills. Because the attack doesn’t announce itself, many small businesses have cryptojacking running on their machines right now without knowing it.

This guide walks through what cryptojacking actually is, how it gets onto business computers, real-world symptoms, and the practical controls that stop it.

What cryptojacking actually is

Cryptojacking is the unauthorized use of a computer’s CPU or GPU to mine cryptocurrency for someone else. The mining software (or “coinminer”) runs in the background, solving the math puzzles that generate cryptocurrency for a mining pool controlled by the attacker. The victim gets no coins — the attacker keeps them all.

Two common flavors:

• Browser-based (in-page JavaScript miners): a script running in a web page uses the browser’s compute while the tab is open. Stops when the tab closes.
• Persistent (installed malware): a coinminer installed on the operating system that runs whenever the computer is on, disguised as a system process to avoid detection.

The persistent variety is the real business problem — it survives reboots, runs 24/7 if the machine is left on, and can spread across the network to hit servers with high compute capacity.

Which cryptocurrencies are being mined

Attackers optimize for coins that are profitable to mine on CPU (Bitcoin isn’t — it requires specialized ASIC hardware). The dominant target in 2026 is Monero (XMR), which is:

• Mineable on ordinary CPUs with reasonable profit.
• Privacy-focused (transactions are hard to trace, so attackers can cash out with less exposure).
• Widely accepted on illicit exchanges.

Other CPU-mineable coins (Ravencoin, Ethereum Classic, various forks) also appear but Monero dominates cryptojacking. If you see XMR mining traffic on your network, you have a compromised host.

How cryptojacking gets onto small business networks

Common entry paths:

• Malicious downloads: employee downloads a “free” software installer that bundles a coinminer. Common with pirated software, cracked games, and utility packages from questionable sites.
• Malicious browser extensions: extension marketed as a productivity tool secretly runs mining scripts on every page load.
• Compromised websites: legitimate site (WordPress plugin vulnerability, injected ad) serves mining JavaScript to visitors.
• Phishing: Word doc or PDF attachment installs coinminer.
• Unpatched servers: attackers exploit an unpatched web server, database, or Exchange server and install mining software as a persistence mechanism (often alongside their real objective).
• Compromised Docker or Kubernetes: exposed Docker APIs or misconfigured Kubernetes clusters are heavily targeted for crypto mining.
• RDP exposed to internet: brute-force RDP login followed by miner installation.

Symptoms of cryptojacking

Signs that a machine or network is being cryptojacked:

• Fan noise on desktop or laptop even when the user isn’t running anything demanding.
• Persistent 80-100 percent CPU usage in Task Manager or Activity Monitor — often shown as a legitimate-looking process (svchost.exe, systemd, kworker).
• Laptop batteries draining faster than they used to.
• Application performance visibly degraded — slow to open, laggy to switch.
• Higher-than-expected electric bills, especially in server rooms.
• Servers running hotter, more aggressive AC use.
• DNS queries to mining pools (pool.hashvault.pro, xmrpool.net, minexmr.com, and similar).
• Outbound network traffic on unusual ports (often 3333, 4444, 5555, 7777, 14444 for Stratum mining protocol).

None of these alone is definitive — a legitimate video render also hits 100 percent CPU — but multiple symptoms together are strong evidence.

Actual damages from cryptojacking

The costs are less dramatic than ransomware but real:

• Electricity: a fully-mining desktop uses an extra 200 to 400 watts continuously. Over a year, that’s $350 to $700 per infected machine at average U.S. commercial rates.
• Hardware wear: constant 100 percent CPU shortens component life. Server-grade equipment is usually fine; consumer laptops running mining for months may not survive it.
• Cloud spend: compromised cloud servers rack up dramatic bills — attackers have generated $50,000+ in a single month on AWS instances configured for high-compute jobs.
• Productivity: 100 percent CPU means the machine is slow for actual work.
• Beach-head risk: the fact that a coinminer is running means an attacker has code execution on your systems. They may be using that access for other purposes too.

The last one is the most important. A cryptojacked machine is proof of compromise. The attacker who installed the miner could add ransomware, exfiltrate data, or pivot to other systems at any time.

Detection and monitoring

Practical detection methods for a small business:

• Endpoint protection with behavioral detection: modern EDR (Microsoft Defender, SentinelOne, CrowdStrike) detects the CPU and memory patterns of mining software.
• DNS filtering: DNSFilter, Cisco Umbrella, and Cloudflare Gateway block queries to known mining pool domains — cheapest and highest-value detection layer.
• Network egress monitoring: unusual outbound traffic on mining ports (3333, 4444, 5555, 7777) from any workstation is a red flag.
• Cloud billing alerts: for AWS/Azure/GCP, set billing anomaly alerts. A sudden 3x jump in EC2 compute cost usually means a compromised instance is mining.
• Task Manager checks during quiet periods: if a workstation is idle at midnight but Task Manager shows 100 percent CPU, investigate.

Prevention: the basic controls

What actually prevents cryptojacking on small business systems:

• Patch management: most persistent cryptominers exploit known vulnerabilities in unpatched servers. Regular OS and application patching closes those paths.
• Restrict admin rights: non-admin users can’t install persistent coinminers, only user-context ones (much easier to detect and clean).
• Endpoint protection: block-listing known mining executable signatures.
• Browser controls: block miner-known-ad networks, install extensions like uBlock Origin or NoScript.
• DNS filtering as noted above.
• MFA on RDP and remote access to prevent brute-force compromise.
• Firewall egress rules: block outbound traffic to mining pool ports and known bad IPs.
• Cloud security posture: lock down exposed Docker/Kubernetes APIs, use IAM roles instead of long-lived credentials.

Response when you find cryptojacking

Treat a discovered cryptominer as a full incident:

1. Isolate the affected machine from the network.
2. Capture the running process list, network connections, and installed persistence mechanisms for forensics.
3. Trace back to how the initial compromise happened — the miner is a symptom, not the root cause.
4. Check other machines on the same network for the same miner (attackers often spread laterally).
5. Rebuild the affected machine from clean install if the persistence is deep enough to make cleanup uncertain.
6. Rotate any credentials that were on or accessible from the compromised machine.
7. If sensitive data was on the machine, follow your notification obligations.

The last step matters. Cryptomining is often the LEAST bad thing an attacker with code execution is doing. Data theft, credential harvesting, or ransomware staging may be running in parallel. Cleanup has to assume the worst until forensics rules it out.

The IR toolkit for small businesses

A basic cryptojacking response follows the same incident response playbook as any other malware incident — detection, containment, eradication, recovery, lessons learned. For teams without an existing IR plan, our Incident Response and Ransomware Toolkit includes a full IR Plan template, a Ransomware First-Response Checklist, three tabletop scenarios, breach notification templates, and an incident log — all customizable to your business in about an hour.

How this fits with your broader security posture

Cryptojacking is one of many outcomes when an attacker gains code execution on a business system. The same controls that prevent it — patching, admin restrictions, EDR, DNS filtering, network egress filtering — also prevent ransomware, data theft, and business email compromise. See our cybersecurity basics for small business for the full defense-in-depth stack that starts with prevention and works down to response.

Key takeaways

• Cryptojacking runs coinminer software on your systems, mining Monero (usually) for the attacker while burning your electricity and CPU cycles.
• Entry paths include malicious downloads, extensions, compromised sites, phishing, and unpatched servers — the same paths as most malware.
• Direct annual cost per infected desktop is $350 to $700 in electricity; cloud infections can generate five-figure bills in weeks.
• The bigger risk is what the cryptominer’s presence implies — an attacker has code execution and could be doing much worse in parallel.
• Prevention stack: patching, admin restrictions, EDR, DNS filtering (highest ROI), egress firewall rules, cloud posture management.

FAQ

Can cryptojacking be legal? A few years ago some sites offered visitors an “opt-in mining instead of ads” arrangement (Coinhive was the most famous). Those largely died out. Any mining that happens without explicit user consent is unauthorized use of the user’s computer resources and violates the Computer Fraud and Abuse Act in the U.S.

Does antivirus catch cryptomining? Modern EDR products do, most of the time. Older signature-based antivirus misses newer variants. If your endpoint protection is a decade-old antivirus product, expect to miss cryptomining. Upgrade to a current EDR.

Are my cloud servers at risk from cryptomining? Yes, disproportionately. Compromised AWS/Azure/GCP instances are the most valuable targets because attackers can spin up powerful compute and put the bill on you. Enable billing alerts, use IAM roles not long-lived keys, and rotate any exposed access keys immediately.