What it is
Cryptojacking is sneaky malware that hijacks your CPU/GPU to mine cryptocurrency for someone else. You pay the price—slowdowns, heat, battery drain—while the attacker collects the coins.
What you may notice
-
Fans roaring and the device runs hot even when idle
-
Apps lag; games stutter; battery drains fast
-
Task Manager/Activity Monitor shows high CPU/GPU from unknown processes
-
One browser tab pins your CPU at 80–100%
How it gets in
-
“Free” cracked software and fake updates
-
Booby-trapped email attachments or installers
-
Rogue browser extensions or websites that run hidden miners
Remove it now: quick steps
-
Disconnect from the internet.
-
Run a full anti-malware scan and reboot.
-
In startup/scheduled tasks, remove unknown entries; delete shady extensions.
-
Update OS, browser, and drivers; clear browser data (cache/site data).
Prevent it
-
Install apps and extensions only from official sources; avoid cracks.
-
Keep OS, browsers, and security tools updated.
-
Use real-time protection and consider blocking known mining scripts.
-
Check Task Manager: if idle usage isn’t idle, investigate.
Browser mining and persistent miners
A browser-based miner usually stops when the responsible tab or extension closes. A persistent coin miner may run as a service, scheduled task, startup item, container, or cloud workload. High CPU or GPU use alone is not proof; identify the process, publisher, command line, parent process, and destination.
Check the full incident
- Remove the delivery file or extension and every persistence entry, then scan again after restart.
- Patch the exposed service or replace the deceptive installer that provided access.
- For cloud mining, revoke compromised keys, review newly created resources, and set cost alerts.
- If the miner arrived with a password stealer or remote-access tool, rotate credentials from a clean device.
Unexpected heat, fan activity, battery drain, and cost spikes are useful clues, but compare them with normal workloads before concluding that mining is malicious.