Cryptojacking runs on your computers for months before most businesses notice. It doesn't steal your data or encrypt your files — it just uses your CPU and electricity to mine cryptocurrency for the attacker. Slow computers, high electricity bills, and overheating hardware are the symptoms.
Cryptojacking peaked in 2018 and declined as cryptocurrency prices fell — then resurged in 2020–2021 and again in 2023 as crypto values rose. It's a low-drama attack compared to ransomware: no ransom note, no encrypted files, no visible incident. Just your computers running at 80–90% CPU while your staff wonder why everything is slow and your electricity bill is higher than expected.
How Cryptomining Malware Gets Installed
The most common delivery methods are: malicious email attachments (drive-by installation during what appears to be a document download), compromised websites (browser-based JavaScript miners that run while the page is open — no installation required), and exploitation of unpatched software (the same vulnerability classes that deliver ransomware are used to install cryptominers as an alternative payload).
Browser-based cryptomining is particularly insidious because it requires no installation — simply visiting a compromised or malicious website runs the miner in the browser tab. DNS filtering blocks connections to known cryptomining pools, eliminating the browser-based variant regardless of whether the user visits a malicious site.
The Business Impact Beyond Electricity
Beyond the electricity cost (which for a small business with 20 computers running at full load 24/7 can represent hundreds of dollars per month), cryptomining malware has secondary impacts: premature hardware failure (sustained high-load operation accelerates thermal wear on CPUs and GPUs), reduced productivity (staff computers running at capacity perform poorly for normal tasks), and the presence of malware that could be repurposed — a cryptominer infection means an attacker has persistent access to your environment and has demonstrated they can execute code on your systems.
Detection and Remediation
SentinelOne EDR detects cryptomining behaviour through process monitoring — identifying processes that consume unusual CPU resources while communicating with known mining pool domains. DNS filtering blocks outbound connections to cryptomining pool domains, stopping browser-based miners regardless of what site was visited. Process monitoring via endpoint management can flag sustained high-CPU processes for investigation.
If you suspect cryptomining: check Task Manager (Windows) or Activity Monitor (Mac) for processes consuming sustained high CPU. Search the process name online. If it's not a recognisable system or application process, it's worth investigating. Your IT team or managed service provider can run a complete endpoint scan and identify any mining activity.
Cryptomining malware is patient and quiet — which is why it often runs for months before businesses notice. The detection controls that catch ransomware catch cryptominers too, typically before the business even realises it's there.
