Cryptojacking surged sharply in 2023. SonicWall Capture Labs threat researchers said total incidents reached 1.06 billion by the end of the year, a 659% increase from 2022. The pace was already striking early on: by early April 2023, the number of hits had moved past the total recorded for the entire previous year. The rise was broad, with nearly every region posting triple- or even quadruple-digit increases.
The attack is also known as malicious crypto mining or crypto mining malware. Instead of asking victims for payment, attackers quietly hijack computing power and electricity from devices such as computers, smartphones, and servers, then use those resources to mine cryptocurrency. That silent operating model is what makes cryptojacking difficult to spot. Many victims only notice it after performance starts to drop.
Browser, file, and cloud attacks follow different routes
Browser-based cryptojacking begins when a user visits a compromised website. Malicious code, often written in JavaScript, runs in the background of the browser without an installation step. It can still consume a large share of CPU capacity, slow the machine down, and push temperatures higher.
File-based cryptojacking is closer to conventional malware distribution. Attackers spread infected email attachments or downloadable files, and once the victim opens them, the malware installs itself and keeps mining in the background. This category can be more damaging because the malicious software may persist after the original infection event.
Cloud cryptojacking targets cloud servers, containers, and related infrastructure. Attackers exploit vulnerabilities or weak configurations, gain unauthorized access, and deploy mining malware inside the environment. The impact can extend beyond a single machine: cloud resources are drained, service performance can degrade, and costs may rise for both providers and customers.
Real-world cases have hit websites, apps, containers, and cloud systems
Coinhive remains one of the best-known examples of browser-based cryptojacking. It offered a JavaScript miner that website operators could embed to mine Monero. The controversy came from how it was used: many site owners did not notify visitors or obtain consent. Complaints spread widely, and Coinhive shut down in early 2019.
On the file-based side, WannaMine targeted Windows systems. It spread through phishing emails and malicious attachments, then used Windows vulnerabilities to install itself on victims’ machines. Infected systems were used to mine cryptocurrency, while users faced sluggish performance and potential damage to their devices.
Cloud environments have also been abused in multiple incidents. In 2018, researchers found that attackers had uploaded malicious Docker container images to Docker Hub. Any system running the infected image could have its resources diverted to mining. Another 2018 case involved Tesla, where attackers used an unprotected Kubernetes console to enter the company’s AWS environment and deploy cryptojacking malware. Tesla later addressed the issue and tightened security in its cloud infrastructure.
Mobile users have not been exempt. Several Android apps discovered on the Google Play Store were presented as legitimate services while secretly mining cryptocurrency in the background. The result was drained battery life and wasted device resources. Google has taken steps to detect and remove such apps, but the threat remains active.
High CPU use, heat, and odd traffic are common warning signs
Cryptojacking is covert, but it often leaves technical traces. One of the clearest signals is abnormally high CPU usage. Devices may become slow, unresponsive, or unstable under sustained load. Overheating is another common symptom, especially when mining activity keeps processors busy for long periods.
Energy use can also provide a clue. Mining consumes substantial electricity, so a sudden jump in power bills may point to unauthorized resource use. On the network side, cryptojacking malware usually communicates with external servers to receive instructions and send mined output. Unusual traffic patterns, or connections associated with mining pools, can be a sign that a system has been compromised.
Security tools can help catch some of this activity. Anti-malware products may detect cryptojacking code or alert users to suspicious behavior. Browser extensions such as NoCoin and MinerBlock are designed to identify and block mining scripts running on websites.
Defense starts with updates, monitoring, and tighter controls
Reducing exposure depends on basic security discipline. Reputable anti-malware software should be installed and kept current. Operating systems, browsers, and plugins also need timely updates, since cryptojacking campaigns often rely on known vulnerabilities. For browser-heavy use cases, tools such as NoScript, uBlock Origin, and MinerBlock can limit or block suspicious scripts.
Performance monitoring matters as much as endpoint protection. Watching CPU load, device temperature, system responsiveness, and energy consumption can reveal a problem before a formal alert appears. Network defenses, including firewalls and intrusion detection systems, are also important, especially in cloud environments where unauthorized access can quickly turn into broad resource abuse.
For browser-based threats, restricting automatic JavaScript execution on untrusted sites remains a practical measure. In enterprise settings, stronger review of third-party container images, application sources, and email attachments can close off common entry points.
Attackers are shifting toward harder-to-protect targets
The article points to two likely directions for the threat. One is the use of more advanced evasion techniques, including polymorphic malware that changes its code to avoid traditional detection. The other is greater focus on Internet of Things devices, which often stay online around the clock but lack strong built-in security.
As cryptocurrency gains wider mainstream acceptance, the financial incentive behind cryptojacking remains clear. For individuals and organizations, the issue is not limited to slower machines. It also touches electricity costs, cloud spending, and the security of the systems connected to those resources.