Cryptojacking Prevention: Detecting and Stopping Unauthorized Mining

Last updated October 2026

Cryptojacking prevention involves detecting and blocking unauthorized cryptocurrency mining scripts that hijack your servers, websites, or employee devices to mine digital currency for attackers. Unlike ransomware, cryptojacking operates silently — consuming CPU resources, inflating electricity bills, degrading application performance, and shortening hardware lifespan — making it one of the most underreported cybersecurity threats facing Indian businesses, particularly those running cloud workloads or customer-facing web applications.

What Exactly Is Cryptojacking and How Does It Work?

Cryptojacking is unauthorized use of computing resources to mine cryptocurrency, typically Monero (XMR), which is preferred by attackers because its mining algorithm runs efficiently on general-purpose CPUs and its transactions are untraceable.

There are three primary attack vectors:

1. Browser-Based Cryptojacking

Malicious JavaScript is injected into a website — either directly by a compromised admin or via third-party scripts (ads, analytics, chat widgets). When visitors load the page, the script mines cryptocurrency using their browser’s CPU. The mining stops when the user closes the tab.

Although the original Coinhive service shut down in 2019, multiple successors (WebMinePool, CryptoLoot, custom WASM miners) continue to operate. In 2025-2026, researchers detected browser mining scripts on over 10,000 websites globally, including Indian government portals and university sites.

2. Host-Based Cryptojacking

Attackers deploy mining software directly on servers, desktops, or IoT devices through:

• Exploited vulnerabilities in unpatched systems (particularly Redis, Docker, Kubernetes, and Jenkins)
• Phishing emails with mining malware attachments
• Supply chain attacks — compromised npm, PyPI, or Docker Hub packages containing embedded miners
• Brute-forced SSH/RDP credentials

3. Cloud Infrastructure Cryptojacking

Attackers steal cloud credentials (AWS, Azure, GCP) and spin up high-CPU instances to mine cryptocurrency. This is particularly damaging because cloud compute is billed per usage. Indian startups using AWS or GCP have reported unexpected bills of ₹5–50 lakh from a single weekend of unauthorized mining activity following a leaked API key.

How Do You Detect Cryptojacking?

Cryptojacking is designed to be invisible. Detection requires monitoring at multiple layers:

Network-Level Detection

• DNS monitoring: Mining pools use known domains (e.g., pool.minexmr.com, pool.supportxmr.com). Monitor DNS queries for connections to known mining pool domains. Tools: Pi-hole, Cisco Umbrella, or any DNS firewall.
• Stratum protocol detection: Mining software communicates with pools using the Stratum protocol (JSON-RPC over TCP). Network IDS/IPS tools like Suricata and Snort have signatures for Stratum traffic.
• Unusual outbound traffic: Mining requires persistent connections to pool servers. Look for long-lived TCP connections to external IPs on common mining ports (3333, 4444, 5555, 8888, 9999) or encrypted connections to unusual endpoints.

Endpoint-Level Detection

• CPU usage anomalies: Sustained high CPU usage (70–100%) on servers or workstations that normally idle is the classic indicator. Set up alerts in monitoring tools (Zabbix, Prometheus, Datadog) for CPU spikes lasting more than 15 minutes.
• Process monitoring: Known miner binaries (xmrig, ccminer, cpuminer, ethminer) and their common disguises (svchost, system, update). EDR solutions like CrowdStrike, SentinelOne, or the open-source Wazuh detect known miner process signatures.
• GPU utilisation: If your servers have GPUs (for ML workloads or graphics), unexpected GPU utilisation is a strong indicator of ETH/ETC mining.

Website-Level Detection

• Content Security Policy violations: A properly configured CSP will block or report inline scripts and connections to unauthorized domains.
• Subresource Integrity (SRI): SRI hashes on external scripts ensure they have not been tampered with. If a CDN-hosted jQuery file is modified to include a miner, SRI will block it.
• Regular malware scanning: Tools like Sucuri SiteCheck, Wordfence, or Patchstack scan for known mining JavaScript patterns.

Cloud Infrastructure Detection

• Billing anomalies: Set up billing alerts in AWS (CloudWatch), Azure (Cost Management), or GCP (Budget alerts). A sudden spike in compute costs is often the first sign of cloud cryptojacking.
• IAM audit: Review IAM roles and access keys for unauthorized usage. AWS CloudTrail, Azure Activity Log, and GCP Audit Logs track API calls that create or start instances.
• Instance type anomalies: Miners typically spin up compute-optimized instances (c5, c6g on AWS). If your workload normally uses t3.small instances, an alert on c5.4xlarge launches catches mining activity.

How Do You Prevent Cryptojacking?

For Websites (Particularly WordPress)

1. Implement Content Security Policy headers that restrict script sources to trusted domains only. In WordPress, use Rank Math or a security plugin to add CSP headers.
2. Use SRI hashes on all external JavaScript and CSS resources.
3. Audit third-party scripts quarterly. Every analytics tag, chat widget, ad network script, and social plugin is a potential injection point.
4. Keep WordPress, themes, and plugins updated. Most website cryptojacking exploits target known vulnerabilities in outdated plugins.
5. Use a WAF (Cloudflare, Sucuri, or Patchstack) that blocks known mining script patterns.

For Servers and Endpoints

1. Patch aggressively. Redis, Docker, Kubernetes, and Jenkins are the most exploited services for mining. Apply security patches within 48 hours of release.
2. Disable unnecessary services. If a server does not need Redis exposed to the internet, firewall it. If Docker API is exposed without authentication (a common misconfiguration), secure it immediately.
3. Deploy EDR/antivirus that detects mining software. Wazuh (open-source) or commercial solutions like CrowdStrike catch known and behavioural mining indicators.
4. Implement application whitelisting on production servers — only approved binaries can execute.
5. Monitor Docker and Kubernetes: Scan container images for mining software before deployment. Tools: Trivy, Grype, or Aqua Security.

For Cloud Infrastructure

1. Never commit API keys to git repositories. Use secret managers (AWS Secrets Manager, HashiCorp Vault). Scan repositories with tools like GitGuardian or TruffleHog.
2. Enable MFA on all cloud console accounts — no exceptions.
3. Set spending limits and alerts: Configure hard spending caps where available, and billing alerts at 50%, 75%, and 100% of expected monthly spend.
4. Use least-privilege IAM policies. A developer’s access key should not have permission to launch large compute instances.
5. Enable GuardDuty (AWS), Defender for Cloud (Azure), or Security Command Center (GCP) — all three have specific cryptojacking detection capabilities.

What Is the Business Impact of Cryptojacking in India?

• Electricity costs: A mid-sized server farm running unauthorized miners 24/7 can add ₹50,000–₹2 lakh monthly to electricity bills in Indian data centres.
• Cloud bills: Compromised AWS/GCP accounts have generated bills of ₹5–50 lakh before detection. Cloud providers may not waive these charges.
• Hardware degradation: Sustained 100% CPU load reduces server and laptop lifespan by 30–50%, accelerating replacement cycles.
• Performance impact: Customer-facing applications become slow, increasing bounce rates and reducing conversion. An e-commerce site mining in visitors’ browsers may see 20–30% longer page load times.
• Legal liability: Under the IT Act 2000 (Section 43), unauthorized use of computer resources (including cryptojacking your website visitors) can result in compensation claims up to ₹5 crore.

Frequently Asked Questions

Is cryptojacking illegal in India?

Yes. Unauthorized use of computing resources falls under Section 43 of the IT Act 2000 (damage to computer systems) and potentially Section 66 (computer-related offences). If a business knowingly embeds mining scripts on its website to mine using visitors’ CPUs, it can face civil liability up to ₹5 crore per affected user and criminal penalties.

Can antivirus software detect cryptojacking?

Most modern antivirus and EDR solutions detect known mining binaries (xmrig, ccminer) and their common variants. However, attackers increasingly use fileless mining techniques that run entirely in memory, or rename miner binaries to evade signature detection. Behavioural detection (monitoring for sustained high CPU usage) is more reliable than signature-based scanning alone.

How do I check if my WordPress site has been cryptojacked?

Run a scan with Wordfence or Patchstack. Manually check your theme’s header.php and footer.php for unfamiliar script tags. Use browser DevTools (Network tab) to look for connections to known mining pools when loading your site. Check your site’s source code for obfuscated JavaScript, particularly in areas like the database (wp_options table for injected widget content).

What should I do if I discover cryptojacking on my cloud infrastructure?

Immediately: (1) Revoke all compromised credentials and API keys, (2) Terminate unauthorized instances, (3) Enable MFA on all accounts, (4) Review CloudTrail/audit logs to determine the entry point, (5) Contact your cloud provider’s abuse team — they may assist with billing adjustments for proven unauthorized usage, (6) File an incident report with CERT-In as required under Indian cybersecurity reporting rules.

Does browser mining still happen after Coinhive shut down?

Yes. Multiple Coinhive alternatives continue to operate, and custom WASM-based miners that do not rely on any third-party service are increasingly common. WebAssembly made it easy to compile efficient mining code that runs in any browser. The threat has evolved from “script kiddie using Coinhive” to “sophisticated attacker deploying custom miners through compromised supply chains.”