Most cyberattacks on small businesses are about stealing something: customer data, money, credentials. Cryptojacking is a bit different. The attacker isn’t necessarily trying to steal from you directly. They want your computers — your processing power, your electricity, your cloud compute budget — to generate cryptocurrency for themselves.

It’s less dramatic than ransomware but can run undetected for months. And because it often piggybacks on other compromises, finding cryptojacking code on your systems is frequently a sign there’s something more serious to investigate.

What Cryptojacking Actually Is

Cryptocurrency mining — particularly for Monero, the most commonly mined coin in cryptojacking attacks — requires significant processing power. Mining pools pay out based on how much compute you contribute. The more machines running mining code, the more the attacker earns.

Attackers solve this by running the mining software on someone else’s infrastructure. Yours, typically, after a compromise. The mining code sits quietly in the background, using CPU or GPU cycles while you carry on using your systems, just more slowly than you’d expect.

There are three main routes cryptojacking reaches small business systems:

Browser-based cryptomining: a malicious or compromised website runs JavaScript mining code in your browser. While your team member has the tab open, their machine is mining. Close the tab, it stops. This was more common before browser makers restricted access to background compute — but it still happens via compromised ad networks and third-party scripts.

Malware on endpoints: a phishing email or drive-by download installs mining software directly on a workstation or server. XMRig is the most commonly deployed tool — legitimate open-source mining software that attackers repurpose. It runs as a background process, often disguised under an innocuous-sounding name.

Cloud account compromise: if an attacker gains access to your AWS, Azure, or Google Cloud account, they can spin up large compute instances — GPU instances especially — and run mining operations at your expense. This is the most financially damaging variant for businesses using cloud infrastructure, because cloud compute bills can run into thousands of pounds in days before anyone notices.

How to Spot It

The telling signs of cryptojacking are performance and cost anomalies:

Unusual CPU usage: cryptomining is compute-intensive. If workstations or servers are running hot, fans are spinning constantly, or Task Manager shows high CPU usage from unfamiliar processes, that warrants investigation. Mining code often throttles itself slightly to avoid obvious detection, so you might see sustained 60-80% CPU usage rather than 100%.

Slow systems: if computers that were fine last month are now sluggish and slow to respond, particularly under normal workloads, mining activity running in the background is one explanation.

Unexplained cloud bills: if you use cloud services and your bill spikes without a corresponding change in your actual workload, check which services and regions the compute is being used in. Cryptojacking via cloud account compromise often shows up as EC2 instances or compute VMs in regions you don’t use, often created at odd hours.

Overheating hardware: sustained high CPU loads generate heat. Workstations running hotter than usual, or server room temperatures rising, can sometimes trace back to mining loads.

What to Do If You Find It

Finding mining code on your systems is a response situation, not just a cleanup task. The malware didn’t get there by accident.

First, isolate any affected systems from the network to stop lateral spread. Then investigate how the code arrived: check recently executed processes, startup entries, scheduled tasks, and any recent downloads or emails. XMRig on a workstation almost always arrived via something — a malicious attachment, a compromised download, a vulnerable application.

If you’re in cloud infrastructure: immediately revoke any credentials that might be compromised, review IAM roles and users for ones you didn’t create, delete any compute resources you don’t recognise, and enable AWS CloudTrail or equivalent audit logging if it wasn’t already running.

Remove the mining software, then treat the machine as potentially fully compromised — there may be other malware present. Reimage if you’re uncertain about what else was installed.

Prevention

Cryptojacking uses the same entry points as other malware, so the standard defences apply:

Keep software updated: XMRig frequently gets onto systems via unpatched vulnerabilities in public-facing servers or applications. Patching promptly removes the routes attackers use most.

Use endpoint protection that detects miners: most current antivirus and EDR products (CrowdStrike, SentinelOne, even Microsoft Defender) include signatures for XMRig and other mining tools. Ensure these are active and updated.

Browser protections: uBlock Origin and similar content blockers block known cryptomining scripts. For staff browsers, a managed browser configuration that blocks malicious script sources provides coverage against browser-based mining.

Cloud billing alerts: if you use AWS, Azure, or GCP, set budget alerts that notify you when spend exceeds a threshold you’d consider unusual. This won’t prevent compromise but gives you early warning before a cloud cryptojacking incident runs up a large bill. Most cloud providers also offer anomaly detection tools in their security consoles.

MFA on cloud accounts: cloud account compromise enabling cryptojacking almost always involves stolen credentials. Multi-factor authentication on AWS root accounts, Azure admin accounts, and Google Cloud console access is a basic control that prevents most credential-based account compromise.

Cryptojacking rarely causes the immediate operational damage of ransomware, but it’s not harmless. Beyond the degraded performance and inflated bills, its presence means your security perimeter has a hole that something else could use. Treat it as seriously as any other malware find.