What is cryptojacking? How to protect your business

Cryptojacking hijacks your computers to mine cryptocurrency for someone else, using your electricity, your hardware and your cloud budget while you get nothing in return. For a business running a handful of laptops, a shared drive and Microsoft 365 or Google Workspace, it can quietly slow everything down for months before anyone notices.

It is easy to dismiss as a nuisance. That is a mistake. The same access that lets an attacker drop a hidden miner on your network lets them steal credentials or deploy ransomware later, and several of the best-known cryptojacking families now do exactly that. This guide explains how cryptojacking works, how to spot it, how to remove it and how to keep it out.

Here is what this guide covers.

• What cryptojacking is and why attackers still bother with it
• The three ways it reaches a business, on devices, in browsers and in the cloud
• Real examples of cryptojacking attacks
• The signs of cryptojacking and how to confirm an infection
• How to remove a miner and prevent the next one
• How Acronis Cyber Protect helps you detect it and recover

Cryptojacking is the unauthorized use of someone else's computing power to mine cryptocurrency. An attacker installs mining software on a device, or runs it inside a web page, so the machine solves the calculations that earn new coins. The coins go to the attacker's wallet. The victim pays for the electricity, the wear on the hardware and, in the cloud, the compute bill.

Cryptocurrency mining on systems you own or are authorized to use may be lawful. Cryptojacking is unauthorized resource use and may violate computer-misuse, fraud, contract and data-protection laws. Legal treatment depends on the jurisdiction and facts of the incident.

Many documented cryptojacking campaigns mine Monero because it supports CPU mining and includes privacy features. XMRig, a legitimate open-source miner, is frequently abused, but process names alone are not conclusive because attackers can rename binaries and legitimate administrators may run mining software with authorization.

Cryptojacking reaches a business in three ways. Understanding which one you are dealing with matters, because the detection and clean-up steps differ.

This is the classic form. A miner is installed on a device and runs as a background process, often disguised with a system-sounding name. It starts when the machine boots, reconnects to a mining pool if it is interrupted and sometimes throttles itself when someone opens Task Manager or when the machine is in active use so that it stays hidden.

More capable variants spread on their own. They scan the local network for machines with unpatched vulnerabilities or weak passwords, copy themselves across, and keep going. One infected laptop can turn into a dozen within a day on a flat office network.

Browser mining runs JavaScript inside a web page, so nothing is installed on the device. The mining lasts as long as the tab is open. Attackers inject the script into compromised websites, malicious ads or browser extensions, and some hide the tab behind the taskbar so it keeps mining after the user thinks they have closed the page.

Browser mining peaked when a service called Coinhive made it easy to drop a mining script into any site. That service has since closed, and browser mining is now a smaller share of the problem, but it has not gone away. Malicious extensions and compromised ad networks still deliver it.

The fastest-growing form targets cloud accounts rather than office PCs. Attackers look for exposed servers, containers and developer tools, or steal cloud credentials through phishing and leaked API keys, then spin up as much compute as the account allows and point it at a mining pool.

The economics are brutal for the victim. In its analysis of a major cloud cryptojacking group, Sysdig calculated that victims pay about $53 in cloud bills for every $1 the attacker earns. Google's own analysis of compromised Google Cloud instances found that the large majority were used for mining, and that in most cases the mining software was installed within 22 seconds of the break-in, which tells you the attacks are fully automated. A small business with one cloud server and a saved credit card can receive a bill in the thousands before the month ends.

Cryptojacking malware uses the same doors as every other kind of malware.

• Phishing emails with malicious attachments or links that install the miner.
• Unpatched software, including operating systems, web servers and remote access tools, exploited by automated scanners.
• Weak, reused or missing passwords on servers, cloud accounts and remote desktop.
• Cracked or pirated applications and fake software updates that bundle a miner with the download. Cracked versions of popular Mac creative apps have been a common carrier.
• Malicious browser extensions, compromised ads and tampered open-source packages pulled into developer projects.
• Stolen cloud credentials and API keys, often harvested by infostealer malware or found in public code repositories.

Cryptojacking volume follows cryptocurrency prices. When coin values rise, mining pays better and attack volume climbs with it. SonicWall's annual threat report recorded more than a billion cryptojacking hits in a single year, a rise of several hundred percent over the year before, and the company has described cryptojacking as a steady, low-profile income stream that criminals turn to when ransomware payouts fall.

Three things keep it attractive to attackers. It is quiet, so a miner can run for months without triggering an incident response. It is cheap, since the mining software is free and the delivery methods are shared with every other malware campaign. And it is low risk, because victims rarely report it and prosecutions are rare.

For a business the risk is the opposite of quiet. A miner is proof that an attacker has a working foothold on your systems. Whether they use it to mine, to steal data or to launch ransomware is simply a question of what pays best that month.

A few campaigns show how the threat has evolved from simple browser scripts to self-spreading malware and cloud-focused operations.

Coinhive started as a legitimate service that let websites earn money by mining in visitors' browsers. Attackers adopted it almost immediately, injecting it into hacked sites, extensions and even public Wi-Fi portals. At its peak it was found on tens of thousands of sites and was one of the most common pieces of malware in the world. The service eventually shut down, which ended the browser-mining boom but not browser mining itself.

Smominru was a Windows botnet that spread using the same EternalBlue exploit that powered the WannaCry ransomware outbreak. It infected more than half a million machines, mostly servers, and mined millions of dollars in Monero. It is a textbook case of why patching matters, because every infection relied on a vulnerability that already had a fix.

This miner infected hundreds of thousands of systems in a matter of days. It stayed dormant when it detected strong security software and crashed the host system if someone tried to remove it, which made clean-up without a good backup painful.

LemonDuck began as a cryptominer and grew into a multi-purpose threat. It spreads through phishing, exploits and brute-forced passwords, steals credentials, disables security tools, removes competing malware and installs miners on both Windows and Linux. It is the clearest example of a miner that is really a general-purpose intrusion.

A group of campaigns, including TeamTNT, Kinsing and the 8220 Gang, specialise in cloud and container environments. They scan the internet for exposed Docker and Kubernetes services, misconfigured databases and unpatched web application servers, then install miners and harvest any cloud credentials they find on the way. These are the operations behind the six-figure cloud bills that occasionally make the news.

A hidden miner costs your business in several ways, even when nothing else seems wrong.

• Employees lose time on sluggish machines, and video calls, design tools and spreadsheets all suffer when the CPU is pinned.
• Power bills rise, and cloud bills can jump by thousands of dollars in a single billing cycle.
• Hardware runs hot and at full load around the clock, which shortens the life of laptops and servers and brings replacement costs forward.
• Staff and whoever handles IT spend hours chasing what looks like a performance problem.
• If the miner also steals credentials, you may face a data breach with the notification duties and reputational damage that come with it.
• A miner is often the first stage of a worse attack. The same foothold can deliver ransomware once the attacker decides it is worth more.

The last point carries the most weight. Treat every miner you find as evidence of a break-in, not as a stray piece of adware.

You can spot cryptojacking without special tools, because mining pushes hardware hard and the warning signs show up in everyday use. Watch for these symptoms across laptops, desktops, servers and phones.

• Machines feel sluggish, freeze or crash more than usual, especially right after startup.
• Devices run hot and fans stay loud even during light work or when the machine is idle.
• CPU or GPU usage sits near maximum when nothing should be running.
• Laptop batteries drain fast, and phones or tablets get warm in a pocket.
• A web page makes the browser crawl, and the slowdown stops the moment the tab closes.
• Electricity bills climb without a change in how the office works.
• Cloud bills spike, new virtual machines appear that nobody created, or a cloud provider sends an unusual-activity warning.
• Antivirus is switched off or will not start, since many miners disable security tools first.

Symptoms tell you to look. These checks tell you what you are dealing with.

1. Check running processes. Open Task Manager on Windows or Activity Monitor on a Mac and sort by CPU. A process you do not recognise using most of the CPU on an idle machine is the first thing to investigate. Search its name and file location before you kill it.
2. Look for known miner names. Files or processes named xmrig, minerd, kdevtmpfsi, kinsing or anything containing the word miner are red flags, but attackers often rename them to look like system components.
3. Close the browser. If CPU use drops instantly, the miner is a web page or an extension. Review installed extensions and remove any you did not add on purpose.
4. Check scheduled tasks and startup items. Miners survive reboots by registering a scheduled task, a login item or a service. Anything unfamiliar that launches at boot deserves a look.
5. Watch outbound network traffic. Miners keep a persistent connection to a mining pool, often on unusual ports. A firewall or router log showing constant traffic to an unknown destination is a strong indicator.
6. Review cloud billing and activity logs. Set up budget alerts with your cloud provider, and check for compute instances, regions or accounts you do not recognise.
7. Run a full scan with endpoint protection that includes cryptomining detection. Modern tools identify miners by behaviour, which catches renamed and freshly compiled variants that signature scanning misses.

If a machine shows signs of cryptojacking, work through these steps in order. Skipping ahead is how infections come back a week later.

1. Isolate the device by disconnecting it from Wi-Fi and the wired network, so a self-spreading miner cannot reach other machines.
2. Remove the miner with your anti-malware tool, then confirm the suspicious process no longer appears after a restart. Delete related scheduled tasks and startup entries by hand if the tool leaves them.
3. For browser mining, uninstall the offending extension and clear the browser's cache and site data.
4. Change every password the device or its user could have exposed, starting with email, cloud and administrator accounts, and revoke any cloud API keys or tokens that were stored on the machine.
5. Patch the vulnerability the miner used to get in. If you do not know how it arrived, assume phishing or an unpatched application and address both.
6. Restore the device from a known-clean backup if the miner disabled security tools, modified system files or resisted removal. A clean image is faster and more reliable than hunting for leftovers.
7. Check the rest of the network. Scan every other machine and review cloud accounts, because a miner on one device usually means the attacker had access to more.
8. Record what happened and what you changed, so the next incident is easier to investigate.

You can cut your exposure sharply with habits that do not require a security team.

• Train staff to recognise phishing emails, avoid untrusted downloads and never install cracked software on a work machine.
• Keep operating systems, browsers and applications patched. Automated patch management closes the exploits that self-spreading miners rely on.
• Use strong, unique passwords and multi-factor authentication on every account, especially cloud consoles, remote desktop and email.
• Run endpoint protection that detects cryptomining by behaviour on every laptop, desktop and server, and make sure nobody can switch it off.
• Use ad-blocking and script-blocking browser extensions, and review installed extensions periodically.
• Lock down cloud accounts. Set billing alerts, limit who can create compute resources, rotate API keys, never store keys in code and close any database or container service exposed to the internet.
• Watch the baseline. If you know what normal CPU, power and cloud spend look like, a miner stands out quickly.
• Keep tested backups, including an immutable or otherwise protected copy, so an untrusted machine can be rebuilt within the recovery time objective defined for that workload.
• Consolidate protection into one integrated platform instead of juggling separate backup, antivirus and patching tools that nobody has time to manage.

People often ask which of the two is the bigger risk. They are different stages of the same problem.

Ransomware is loud. It encrypts files, announces itself with a ransom note and stops work immediately. Cryptojacking is quiet. It steals resources slowly and is designed to stay unnoticed for as long as possible. Attackers switch between the two depending on what pays. When ransom payments drop, mining rises, and when coin prices fall, miners get swapped for ransomware.

The practical lesson for a small business is that both arrive through the same doors, phishing, unpatched software and weak passwords, and both are defeated by the same combination of prevention and verified backups. Protect against one and you have largely protected against the other.

Cryptojacking malware hides on endpoints and can open the way to worse attacks. Without a way to detect it, remove it and recover clean systems, a business loses performance, money and sometimes data. Handling that with separate backup and security tools is hard for a company without dedicated IT.

Acronis Cyber Protect combines backup, recovery and security capabilities in a centrally managed platform. Exact features depend on the product version, deployment model, workload and license.

• Acronis Active Protection uses AI-based behavioural analysis to detect and stop cryptomining processes and ransomware on your endpoints, including renamed miners and new variants that have no signature yet.
• URL filtering blocks the compromised sites, malicious ads and fake update pages that deliver miners and browser-based mining scripts.
• Vulnerability assessment and patch management find and fix the unpatched software that self-spreading miners exploit.
• Full-image and file-level backup can support recovery, while immutability can protect eligible backup destinations during a configured retention period. Immutability does not by itself prove that a recovery point is malware-free, so combine it with scanning and restore testing.
• Backup validation confirms that your backups actually restore, before you need them.

Everything runs from a single console. A team without dedicated IT can deploy protection to every device, schedule automatic backups and see at a glance which machines are protected and which need attention.

Cryptojacking rarely makes the news, which is exactly why it works. A miner can sit on an office PC or a cloud server for months, costing you money and performance while signalling that someone else has access to your systems.

The defence is the same layered approach that stops ransomware. Keep software patched, use strong authentication, run endpoint protection that spots mining by behaviour and keep tested, immutable backups so any compromised machine can be restored quickly.

To see how this fits your setup, learn more about Acronis Cyber Protect and how it detects cryptojacking, stops it and helps you recover.