CyberGuard dictionary / Malware
Cryptojacking
Cryptojacking is unauthorized use of someone else's computing resources to mine cryptocurrency.
In simple terms
An attacker uses a device or cloud account to do mining work, leaving the owner with the cost and performance impact.
Technical explanation
Mining processes may run on compromised endpoints, servers, containers, or browser sessions. Indicators include unexpected CPU use, energy or cloud bills, and suspicious process or network behavior; the entry path still needs investigation.
Unauthorized mining consumes computing resources and can raise costs, reduce performance, or indicate broader compromise. The miner may run in a cloud workload, browser, or infected endpoint.
Examples in practice
A stolen cloud credential starts many compute instances that mine coins until the account owner notices a billing spike.
A cloud bill spikes after a leaked access key creates new compute instances. The team revokes the key, stops the instances, and checks what else the credential could access.
Why it matters
The visible cost may be only one sign of a broader compromise that allowed the miner to run.
VERIFY & LEARN MORE
Sources and further reading
- learn.microsoft.comhttps://learn.microsoft.com/en-us/defender-xdr/criteria↗
- attack.mitre.orghttps://attack.mitre.org/techniques/↗
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.