What Is Cryptojacking? Why Your Computer Might Be Secretly Mining Crypto for Someone Else

Your laptop is running slowly. The fan is spinning like it's trying to take off. You haven't opened anything demanding, just a browser tab or two. So what's going on?

One possibility: your device is mining cryptocurrency for a stranger.

Cryptojacking is one of those threats that's easy to miss precisely because staying hidden is the whole point. There's no ransom note. Nothing gets stolen from your accounts. The attacker just quietly borrows your processing power, and you foot the electricity bill while they pocket the profits.

It's more common than most people realize. In the first half of 2023 alone, SonicWall recorded 332 million cryptojacking attacks globally, a 399% increase year-over-year. Since then, attackers have increasingly shifted from browser-based scripts toward hijacking cloud computing workloads, but the underlying tactic, stealing someone else's processing power to mine cryptocurrency, remains widespread. This isn't a fringe threat.

What makes it especially insidious is how unremarkable it feels from the victim's side. Your device just seems a little sluggish, a little warm. Easy to chalk up to a software update running in the background, or too many tabs open. That ambiguity is a feature, not a bug, from the attacker's perspective. The longer you don't notice, the longer they profit.

Here's what cryptojacking actually is, how it gets onto your device, and what you can do about it.

What is cryptojacking?

Cryptojacking is the unauthorized use of your device's computing power to mine cryptocurrency. The attacker gets the coins. You get a slower machine and a higher energy bill.

To understand why this works, it helps to know a little about how cryptocurrency is created. Coins like Bitcoin and Monero aren't printed. They're "mined" by computers solving complex mathematical problems, essentially racing to verify transactions and add them to a public ledger called the blockchain. The first machine to solve the problem earns a reward in cryptocurrency. That process requires enormous processing power, and the electricity to sustain it. Mining rigs capable of doing this at scale cost thousands of dollars to build, run, and cool.

Cryptojackers skip that cost entirely. Instead of building their own infrastructure, they hijack yours. By spreading their mining workload across hundreds or thousands of compromised devices, they get the computational output of a large operation without paying for any of it.

Monero is the most common target for this kind of attack. Unlike Bitcoin, which now requires specialized hardware called ASICs to mine competitively, Monero is specifically built to be mined on regular consumer hardware, ordinary CPUs found in laptops and desktops. That makes it ideal for cryptojacking, because any device the attacker compromises is immediately useful. It also has stronger privacy features than Bitcoin, which makes it harder to trace transactions back to the attacker. Those two properties together make Monero the coin of choice for cryptojackers targeting everyday devices rather than data centers.

How does cryptojacking get onto your device?

There are two main ways this happens, and they work very differently.

Browser-based cryptojacking is the more passive form. You visit a website, and a small JavaScript snippet begins running in the background. That script uses your CPU to mine cryptocurrency for as long as your browser tab stays open. You don't have to download anything. You don't have to click anything suspicious. Simply loading the page is enough.

This method exploded in popularity after a service called Coinhive made it trivially easy for website operators to embed mining scripts into any page. Coinhive marketed itself partly as a legitimate alternative to advertising revenue, site owners could theoretically use it with visitor consent, but it was quickly and widely abused. Coinhive shut down in 2019, but the approach it pioneered is still actively used by attackers who inject similar scripts into compromised or malicious sites. A legitimate website that gets hacked can unknowingly serve these scripts to every visitor, meaning you can encounter browser-based cryptojacking on sites you've trusted for years.

Malware-based cryptojacking is more persistent and more serious. Here, the attacker gets mining software installed directly onto your device, usually through a malicious email attachment, a fake software download, a compromised app, or a drive-by download from an infected site. Once it's on your system, the miner runs continuously in the background, whether or not you're browsing anything. It restarts when you reboot. It hides behind legitimate-looking process names. It doesn't stop until something actively removes it.

As Malwarebytes notes, processes used by these miners often mask themselves as something legitimate to make detection harder, names that look like standard Windows or macOS system processes, built to blend in when you glance at your task manager. That's what makes the malware variant so much more damaging over time. Browser-based mining stops the moment you close the tab. Malware-based mining keeps going around the clock.

What are the warning signs of cryptojacking?

Because cryptojacking is built to stay hidden, the symptoms look a lot like ordinary device wear and tear. That's intentional. The more it resembles normal slowdown, the longer it goes undetected.

Watch for these signs:

• Unusual slowness during tasks that normally run fine, like browsing, writing, or streaming
• Overheating more than usual, especially without any heavy applications open
• Fan running constantly or louder than normal, even when your device is idle
• Battery draining faster on a laptop or phone, without an obvious reason
• CPU usage spiking when you check your Task Manager (Windows) or Activity Monitor (Mac), especially from processes you don't recognize
• Higher electricity costs over time with no change in your usage habits

None of these on their own confirm cryptojacking. But if you're seeing several at once, it's worth investigating. Open your task manager and look for anything consuming unusually high CPU that you didn't open. If something looks suspicious, search the process name before killing it, some high-CPU processes are legitimate system functions, and you want to be sure before interfering.

One reliable test: if the slowdown disappears the moment you close a specific browser tab, that tab was likely running a mining script. You can also try opening a fresh browser window with no tabs loaded and watching whether CPU usage drops significantly. If it does, the culprit is almost certainly browser-based.

Some attackers deliberately throttle their scripts to use only a portion of your CPU (say, 50% rather than 100%) specifically to avoid triggering obvious symptoms. A device that's running slightly warmer and slightly slower than usual, but not dramatically so, can host a mining script for months without the owner ever suspecting anything.

Why does it matter if it's 'just' using your CPU?

A fair question. Nothing got stolen. Your files are intact. So why does this actually matter?

A few reasons.

Sustained high CPU load shortens the lifespan of your hardware. Components run hotter for longer than their design intended. Thermal stress accumulates over time, degrading processors, fans, and batteries faster than normal use would. Over weeks or months, that adds real wear. It can also make your device unstable, causing crashes or freezes during normal use, at the worst possible moments.

There's a financial cost too. The electricity your device burns mining cryptocurrency for someone else shows up on your bill. For a single laptop it might be modest, but if you're running a small business with multiple machines, or if the infection persists for months, those costs become meaningful.

And perhaps most importantly, if a cryptojacking script or piece of malware got onto your device, it means something bypassed your defenses. A compromised website served you a malicious script. A download slipped past your attention. Whatever the entry point was, it's still there. The same vulnerability or the same lapse in judgment that let the miner in could let something worse in next time, ransomware, a keylogger, or credential-stealing software that does cause direct, immediate harm.

Cryptojacking is often the first sign that a device or network has a gap worth closing.

How do you protect yourself from cryptojacking?

The good news is that most cryptojacking is preventable with a few basic habits and the right tools.

Keep software updated. Many cryptojacking attacks exploit known vulnerabilities in browsers, operating systems, or plugins. Updates patch those gaps. This is one of the simplest and most effective things you can do, most successful attacks target vulnerabilities that already have patches available, but haven't been applied yet.

Be careful what you install. Malware-based cryptojackers most often arrive through fake downloads, cracked software, or suspicious email attachments. Pirated software and unofficial app sources are particularly high-risk vectors. If you didn't go looking for it, or if the source seems even slightly off, don't install it.

Use a browser-level security extension. Browser-based cryptojacking scripts run the moment you visit a compromised page. A security extension that monitors your browser activity in real time can detect and block those scripts before they ever run. This is where tools like Guardio come in. Guardio runs directly in your browser, scanning pages as you visit them and flagging or blocking threats it detects, including malicious scripts running in the background. Because it operates at the browser level, it can catch threats that traditional antivirus software, which typically scans files on your device, might not see until it's too late.

Monitor your device's performance. You don't need specialized software. Just make a habit of occasionally checking Task Manager or Activity Monitor. Unexplained CPU spikes are worth noticing, especially if they correlate with specific websites or applications.

Use ad blockers or script blockers on unfamiliar sites. Browser-based miners often piggyback on ad networks or compromised site scripts. Extensions like uBlock Origin can block the kinds of third-party scripts that mining code typically uses. Blocking scripts on sites you don't trust adds an extra layer of friction for attackers.

No single step is a guarantee. The most reliable defense is a combination of good habits and real-time protection that can catch what you miss.

Conclusion

Cryptojacking isn't the most dramatic threat out there, but it's one of the quietest and most widespread. You might have it right now and have no idea.

The people running these attacks aren't targeting you specifically. They're casting wide nets, compromising as many devices as possible to build up aggregate mining power. Your laptop is just one node in their network, one of potentially thousands being quietly drained at the same time. Individually, each device contributes a small amount. Collectively, that adds up to real money for the attacker.

The damage to you is gradual rather than sudden. Hardware wears down faster. Electricity bills creep up. And the same gap in your defenses that let the miner in remains open for something worse. That's the part worth taking seriously.

The fix isn't complicated. Stay updated, be careful with downloads, and give your browser the kind of real-time protection that can catch these scripts before they get comfortable. A few deliberate habits, combined with a tool that actively monitors your browsing environment, go a long way toward closing the door on this kind of attack.

Get a free security scan with Guardio today and stay protected from browser threats.