How does cryptojacking work and how do you defend against it?

Cryptojacking is the unauthorized use of someone else's computing power to mine cryptocurrency. An attacker gets code running on a server, container, cloud account or device, then spends your processor time and your cloud bill to earn money for themselves. The signs are sustained high CPU and connections to mining pools.

How does it work?

MITRE ATT&CK files this under Resource Hijacking (T1496), a technique in the Impact tactic. It describes adversaries using the resources of co-opted systems for resource-intensive tasks, which may affect the availability of the system or hosted service. Mining cryptocurrency is the best known example. The same technique also covers selling network bandwidth to proxy networks, generating SMS traffic for profit, and abusing cloud messaging services to send spam.

The attacker's steps are usually simple: get in, install a miner, make sure it restarts, and keep the load low enough to avoid notice. Entry routes are the usual ones: exposed management interfaces, weak or leaked credentials, vulnerable web applications, malicious packages and exposed container or cloud control APIs. ATT&CK platforms for the technique include containers, IaaS, Linux, SaaS, Windows and macOS.

What does it cost you?

Slower systems, higher electricity or cloud bills, shortened hardware life and, in a shared environment, degraded service for real users. It is also a signal that someone had code execution on your systems. The miner is often the least harmful thing the same access could have done.

How do you detect it?

ATT&CK notes that this technique cannot be easily mitigated with preventive controls because it is based on the abuse of system features. So detection matters. Its detection analytics describe patterns such as:

• persistent high CPU use with suspicious command lines, such as mining tools or obfuscated scripts, and outbound connections to mining or proxy networks
• unauthorized processes using abnormal CPU and memory, with persistence through cron jobs or scripts
• sudden spikes in cloud virtual machine CPU with outbound traffic to mining pools and unauthorized instance creation
• unauthorized containers running mining binaries

A constructed example

A company's cloud bill rises 40 percent in a week with no matching traffic increase. A look at the account shows a dozen new instances in a region the team never uses, created with an access key that had been committed to a public repository months ago. Each instance runs one process at full CPU and talks to one external address. The response is to delete the instances, revoke and rotate the key, review what else the key could do, and set a billing alert and a region restriction so the same thing is noticed in hours instead of days.

How do you defend against it?

Protect credentials. Cloud keys in repositories are a classic source. Use secrets scanning, short lived credentials and narrow permissions. Safeguard's secrets scanning helps find keys in code before they leak.

Reduce exposure. Do not expose container APIs, dashboards or databases to the internet. Patch internet-facing software quickly.

Control dependencies. Malicious or compromised packages can carry miners. Inventory and review what you install.

Set limits. Resource quotas on containers, restricted regions and accounts, and spending alerts cap the damage.

Monitor behavior. Alert on sustained CPU from unexpected processes, new instances and outbound connections to unfamiliar addresses.

How to check or apply this

1. Set billing and usage alerts on every cloud account, and restrict unused regions.
2. Scan repositories and CI logs for keys, and rotate any you find.
3. Close public access to container and cloud management interfaces.
4. Set CPU and memory limits on containers and alert when they are hit for long periods.
5. Log process starts and outbound connections, and alert on connections to known mining pools.
6. When you find a miner, treat it as a breach: find the entry point, rotate credentials and review other activity.

Quick check

Sources

• MITRE ATT&CK T1496, Resource Hijacking

Last reviewed: 18 October 2026.