Cryptojacking is a malicious account – the sort when someone uses your computer, phone, browser, server, or cloud account to mine cryptocurrency without asking. They keep the rewards; you cover the cost in processing power, electricity, battery life, cooling, and sometimes a nasty cloud bill.
The warning signs are easy to brush off: a laptop fan that won’t quit, a phone that’s warm even when idle, everything running sluggish with no demanding app open, a cloud bill that jumps for no clear reason. None of these prove a cryptojacking attack alone, but a few showing up together is worth investigating.
In this post, I’ll discuss seven signs someone might be mining crypto on your device, how to check devices and cloud accounts, and how to prevent cryptojacking without treating every busy CPU as malware.
Also read: Crypto Wallet Security in 2026: How to Protect Private Keys and Seed Phrases
Key Takeaways
- Cryptojacking uses your device or account to mine crypto without permission.
- Persistent CPU or GPU activity while idle is the strongest first clue.
- Heat, loud fans, battery drain, slow performance, unknown startup items, and odd cloud usage add context.
- Recent campaigns use fake software downloads, remote-access tools, poisoned search results, and GPU miners.
- If you spot suspicious activity: preserve evidence, scan the device, remove persistence, update everything, and change important passwords from a clean device.
What is Cryptojacking and How Does it Work?
Cryptojacking is a form of resource hijacking. MITRE ATT&CK classifies it as technique T1496 and lists cryptocurrency mining as one way attackers exploit compromised systems. It hits Windows, macOS, Linux, containers, and cloud infrastructure alike.
Mining takes actual computing work, which eats up processor time, memory, electricity, cooling, and bandwidth. A cryptojacking attack shifts those costs onto you while the rewards land in the attacker’s wallet.
Three main ways this plays out:
- Browser-based mining: A compromised site, a malicious ad, or an injected script runs mining code inside a browser tab. It usually stops when you close the tab. You don’t even need to download anything; just landing on a compromised page can spike resource use.
- Installed mining malware: Someone downloads a fake utility, opens a sketchy attachment, or runs cracked software. The miner quietly runs in the background, often planting a startup entry, scheduled task, service, registry key, or launch agent so it survives a restart.
- Cloud and server abuse: Attackers steal cloud credentials, exploit a vulnerable service, or find a misconfigured container, then spin up new virtual machines or hijack existing compute. Here, an unexpected cloud invoice is often the first sign, not a hot laptop.
Which coin gets mined matters less than the fact your resources are used without consent. CPU-friendly privacy coins have historically drawn attackers, though newer campaigns increasingly target powerful GPUs.
Seven Signs of Cryptojacking On Your Device
CPU or GPU usage stays high while idle
- Close games, video editors, virtual machines, downloads, and unneeded browser tabs
- Wait a few minutes, then check whether usage stays high anyway
- Track down whatever process is responsible
On Windows, open Task Manager (Ctrl + Shift + Esc) and check Processes, Performance, and Startup apps. On macOS, Activity Monitor covers CPU, GPU, Energy, memory, disk, and network.
The word “stays” in usage stays high matters: a short burst could well be just an update or a scan. But persistent, unexplained activity from a process in a weird location or making odd connections is what should get you suspicious.
Your device gets hot and the fans won’t quiet down
Mining is a sustained workload, so your laptop can sound like it’s grinding away even during email. Watch for warm air from a laptop, a fan that never settles, or a phone that heats up while idle.
Heat alone proves nothing; dust, charging, video calls, and a hot room cause the same symptoms. Compare heat and fan noise against your resource graphs. Apple recommends checking GPU activity when a Mac feels hot or drains battery fast.
Your battery life suddenly tanks
Cryptojacking keeps the processor busy nonstop, so batteries burn faster than usual.
- macOS Activity Monitor’s Energy tab shows each app’s impact.
- Windows Task Manager surfaces abnormal CPU or GPU activity.
- Mobile OSes give battery and data-use reports by app.
Compare drain against recent installs, updates, and battery health. The clue strengthens when an unrecognized app tops the battery list, or the same process reappears after every restart.
Everyday tasks feel slow or unstable
Resource theft leaves less capacity for real work: pages load slowly, typing lags, video stutters, apps take longer to switch. Cryptojacking hits servers the same way, slowing applications competing with a miner for CPU, memory, or GPU.
I’d suggest comparing against the device’s normal baseline. A newer computer turning sluggish right after installing a “driver updater” deserves a closer look, though low storage and older hardware cause this too.
Trouble started right after a sketchy download or install
Timing tells you a lot, in my opinion:
- Did the fan get loud after installing a free utility?
- Did your phone heat up after an app from outside the official store?
- Did the browser slow down after a new extension?
- Did things go sideways after opening an email attachment?
Microsoft’s May 2026 campaign used fake sites copying popular Windows utilities, ZIP archives, DLL sideloading, and ScreenConnect for remote access. Verify the publisher, domain, and signature before installing anything, and be wary of recommendations from search results or an AI chatbot without a confirmed official link.
Unknown processes, startup entries, or remote-access tools show up
Watch for apps you don’t remember installing, unrecognized extensions, vague services, and scheduled tasks or startup entries launching from Downloads, Temp, or AppData.
Microsoft’s 2026 investigation found six persistence mechanisms, including registry Run keys, and even used process hollowing inside a legitimately signed utility. A familiar process name doesn’t mean it’s safe; check its file path, publisher, and signature before deleting anything. On a work device, send those details to IT, since this is often one piece of a bigger compromise.
Network activity or cloud charges stop matching your use
Browser-based mining shows up as high CPU tied to a specific tab. Close tabs one at a time, watch usage drop, then remove unfamiliar extensions. For business accounts, check mining-pool connections, unexpected virtual machines, new containers, and pricier instance types.
Microsoft has documented cloud cryptojacking cases running up more than $300,000 in compute fees. A network spike alone proves nothing; the signal strengthens when it appears alongside mining infrastructure or an unapproved permission change.
How to Check Whether Crypto Mining is Happening
Windows
Close demanding apps, open Task Manager (Ctrl + Shift + Esc), sort by CPU/GPU/Network, and watch while idle. For anything suspicious, check its file location, publisher, and signature. Review Startup apps, then run a Windows Security scan. Don’t trust one screenshot; some miners pause when Task Manager opens, so check again after a restart.
macOS
Open Activity Monitor (Applications > Utilities) and check CPU, Energy, GPU, and Network for idle activity. kernel_task can spike for thermal management, which isn’t exactly proof of mining by itself. Review recent installs, Login Items, and extensions.
Android and iPhone
I use Android, and I check battery use, data use, recent installs, and anything installed outside Google Play; and also keep Play Protect on. On iPhone, you should ideally check Battery usage, remove unrecognized apps, and follow Apple’s guidance if it flags malware. A hot phone can also just mean poor signal, navigation, or an aging battery, so look for several signs together.
Cloud accounts and servers
Check billing dashboards, usage reports, audit logs, IAM changes, access keys, regions, and containers. Set budget alerts now. If you find a suspicious workload, isolate it, preserve logs, revoke exposed credentials, and contact your cloud provider before deleting anything.
How to Prevent Cryptojacking
There’s no single fix, in my opinion. I’d rather go for a layered defense.
- Keep everything updated: OS, browser, apps, firmware, and security patches close the vulnerabilities attackers use to plant miners. CISA specifically recommends this against illicit crypto mining.
- Download only from the real publisher: Use official sites or trusted app stores and check the domain. Skip mirror sites, cracked software, and links surfacing only in questionable search results; Microsoft’s 2026 campaign shows how convincing fake look-alikes can be.
- Keep browser protections and extensions in check: Leave Safe Browsing on, keep only extensions you use, and review their permissions.
- Use antivirus correctly: Keep real-time and cloud-delivered protection on, and don’t create exclusions just to force an unknown program to run; Microsoft’s campaign specifically abused Defender exclusions to dodge detection.
- Protect accounts and cloud resources: Use unique passwords, a password manager, multifactor authentication, least-privilege permissions, short-lived credentials, and budget alerts. Limit who can spin up large instances, and alert on new instances, keys, regions, and CPU/GPU spikes.
- Pause before installing anything: Confirm the publisher, permissions requested, and whether the download page is legitimate. Never disable a security warning because a tutorial told you to.
Also read: 5 Biggest Crypto Hacks of All Time and What They Teach Us About Security
What To Do After Finding a Cryptojacking Attack
If a personal device is actively mining, disconnect it once it’s safe to do so.
- Screenshot the process, file path, startup entry, or cloud resource.
- Run a full scan with updated security software.
- Remove the malicious app, extension, persistence mechanism, or workload once you’ve documented enough.
- If the process returns after a restart, or an unauthorized remote-access tool turns up, treat the device as compromised.
Change important email, banking, exchange, and work passwords from a separate, clean device, turn on multifactor authentication, and loop in IT or an incident-response professional.
If you can’t pin down what changed, a clean reinstall from official media is often safer than repeatedly deleting files. A real cryptojacking attack calls for investigating how the attacker got in, not just killing one process.
Also read: How AI is Fueling Crypto Hacks: Ledger CTO’s Guide to Crypto Wallet Security
When These Signs Don’t Actually Mean Cryptojacking
High usage is a necessary but not sufficient condition here.
Video calls, games, browser tabs, indexing, backups, operating-system updates, cloud sync, virtual machines, dust, heat, old batteries, and failing hardware can all create similar symptoms.
The strongest evidence is a cluster of signs: sustained unexplained resource use, a suspicious installation, persistence after restart, unknown network connections, or an unexpected cloud resource.
If you notice only one symptom, troubleshoot ordinary performance causes first.
The Bottomline
Cryptojacking turns a device you pay for into someone else’s mining rig. The cost shows up as slower work, extra heat, drained batteries, a bigger electricity bill, a surprise cloud invoice, or a wider security incident.
Check your resource graphs, recent downloads, startup behavior, network activity, and security alerts together; that combination beats a scary process name every time.
Prevention stays practical: update promptly, download carefully, keep security protections on, limit account permissions, watch for unusual usage, and investigate anything that keeps coming back after a restart.
For more info on crypto and all things Web3, visit Blockverse.
FAQs
Unauthorized cryptocurrency mining on someone else’s computer, phone, server, or cloud account. The attacker pockets the reward while you supply the processing power, electricity, battery, or cloud budget.
Mining alone doesn’t prove anything was copied, but the malware behind a cryptojacking attack can also install remote-access software or quietly weaken security settings. Investigate the whole infection, especially when persistence mechanisms or credential warnings are present.
Yes. A malicious app, browser page, or sideloaded package can hammer a phone’s processor. Battery drain, overheating, unexpected data use, and an unrecognized recent install are all useful clues to watch for, though each one has harmless explanations too. Use Play Protect on Android and follow Apple’s malware guidance on iPhone.
No. It can come from legitimate software, updates, indexing, gaming, or aging hardware. It’s more suspicious when it continues while idle, starts after a questionable download, returns after a restart, or traces to an unknown process in an unusual location.
Keep your OS and browser updated, install software only from official sources, leave antivirus and Safe Browsing on, review your extensions and startup apps regularly, use multifactor authentication everywhere you can, and avoid pirated software.
Use least-privilege IAM, multifactor authentication, protected secrets, short-lived credentials, budget alerts, audit logs, and monitoring for new instances, keys, regions, and unusual CPU or GPU use. If an attack happens, isolate the workload, revoke credentials, preserve logs, and contact your cloud provider.
No. Mining is legitimate when the hardware owner controls it and knowingly consents to the workload running. Cryptojacking is unauthorized mining or resource abuse; consent, transparency, and the ability to stop the activity whenever you want are what separate the two.
