What is cryptojacking?¶

Cryptojacking is the unauthorised use of another person’s device, account or service to perform cryptocurrency mining.

Evidential caution: that cryptojacking always requires malware installed on a computer.

What this means¶

It may also involve:

browser-based scripts;

compromised cloud accounts;

abused containers;

stolen API keys;

malicious extensions;

compromised websites;

unauthorised virtual machines;

remote-management tools.

how the mining workload was introduced;

which account or session created it;

which systems or cloud resources ran it;

whether the activity persisted;

what pool or wallet received credit;

what cost or service impact resulted.

A compromised website may cause visitors’ browsers to mine temporarily.

A stolen cloud credential may create large numbers of mining instances.

These are different routes and should be investigated separately.

They may be victims.

Cryptojacking can also spread through shared images, templates or deployment pipelines. One compromised image may create similar mining workloads across many systems without repeated manual installation. Compare image identifiers, launch times and configuration before assuming separate intrusions.

Browser-based mining may stop when the page closes and leave little persistent code. Preserve browsing history, cached scripts, page content, process activity and network connections. A compromised website owner may have no knowledge that visitors’ resources were being abused. The operational takeaway is:

================================================================================

What to check or do next¶

• Investigators should establish:
• Identify the route that introduced the mining workload, the resources consumed and the account or wallet benefiting, and keep victim ownership separate from offender control.

Evidential limits¶

Do not assume the subscriber, website owner or cloud-account holder knowingly authorised the activity.

Likewise, a mining process on one system does not prove the same actor controlled every related workload.