What is Cryp­to­jack­ing?

In cryp­to­jack­ing, cy­ber­crim­i­nals infect computers and mobile devices with malware in order to use their computing power to generate cryp­tocur­ren­cies. An infection can be detected by an in­ex­plic­a­bly high CPU load. Several methods help to detect, stop, and prevent cryp­to­jack­ing.

Cryp­to­jack­ing – from “cryp­tocur­ren­cy” and “high­jack­ing” – is a hybrid malware trans­mit­ted in the form of Trojans and scripts. Cryp­to­jack­ers have pretty much replaced ran­somware and viruses as one of the biggest online threats globally. In­fil­trat­ed systems are hijacked by criminals un­de­tect­ed for cryp­to­min­ing of cryp­tocur­ren­cies. As a result, CPU usage and energy con­sump­tion are extremely high. Unlike other malware, cryp­to­jack­ers are primarily in­ter­est­ed in hijacking computing resources; spying on sensitive user or system data does not play much of a role.

Cryp­to­jack­ing is linked to the process of cryp­to­min­ing. In cryp­to­min­ing, miners provide their own computing capacity or combined ca­pac­i­ties (when part of pools) in order to le­git­imize and verify trans­ac­tions with cryp­tocur­ren­cies and to document them in the blockchain. To ensure the legality of trans­ac­tions, Bitcoin trans­ac­tions, for example, are publicly recorded. However, anonymized altcoins such as Monero and Ethereum, offer criminals the necessary anonymity for illegal trans­ac­tions via hijacked systems.

As cryp­to­min­ing becomes more resource-intensive and time-consuming, prof­itable mining in­creas­ing­ly depends on high computing ca­pac­i­ties and expensive power con­sump­tion. Illegal mining in the form of cryp­to­jack­ing aims to use other people’s computing resources to generate profits without incurring any of their own operating costs. To this end, affected systems are often added to mining botnets that act as illegal mining pools and bundle computing power.

Becoming part of a large-scale cryp­to­jack­ing network un­in­ten­tion­al­ly and un­know­ing­ly is easier than you think. You could be lured in by scareware and end up clicking on a link that leads to an infected website or download a third-party app from a dubious source. The only thing you may notice is a slower system, because a Trojan will use the computing ca­pac­i­ties of your PC or mobile device in the back­ground.

Home users are not the sole target of cryp­to­jack­ers: famous cryp­to­jack­ing have involved major brands and busi­ness­es such as, for example, Tesla Motors, where employees used un­pro­tect­ed ap­pli­ca­tions infected with cryp­to­jack­ing scripts. Another well-known case was the Wi-Fi provided by Starbucks stores in Buenos Aires, through which the computing power of connected laptops and mobile devices was hijacked. Other examples include the websites of Cristiano Ronaldo and the San Diego Zoo, which un­know­ing­ly used the mining program Coinhive to mine computing powers of site visitors.

Depending on how foreign computers or mobile devices are used for cryp­to­jack­ing, one dis­tin­guish­es between the following cat­e­gories of dangerous malware:

• Cryp­to­jack­ing through Trojans/adware: Systems that become infected with a cryp­to­jack­ing Trojan through infected websites, files, downloads, or other means are used to make CPU or GPU available for mining. Since they bypass antivirus programs and the task manager, they typically remain un­de­tect­ed for a long time.
• Cryp­to­jack­ing through JavaScript/browsers: Here, mining code is hidden in scripts, e.g., in the form of code snippets of the Coinhive program, in websites and executed by the browser. Visitors to a website un­know­ing­ly make their computing power available for mining, possibly even after they have navigated away from the site which is possible through hidden popups or tabs. Since streaming portals keep their users on-page for a long time, they are also affected by mining codes in video players or disguised cryp­to­jack­ing ads.

It seems ironic for the maker of the Coinhive JavaScript code, widely used for cryp­to­jack­ing, to claim that Coinhive is an al­ter­na­tive to classic ad banners. But the idea behind a code like Coinhive is not illegal. Provided it is not abused. In principle, a code in­te­grat­ed into websites, via which visitors con­scious­ly agree to mining, can be a safe al­ter­na­tive to ad­ver­tise­ments that lead to malicious scam or phishing sites or stealing of sensitive user data.

The pre­req­ui­site for this is that page visitors agree to offer a portion of their computing power for the website visit, as is the case with cookie queries. In this way, website operators finance them­selves even without a high density of un­con­trolled ad­ver­tis­ing. However, this could only be im­ple­ment­ed through in­de­pen­dent standards and trans­paren­cy of cryp­to­min­ing codes in web projects. A suc­cess­ful example for the legal use of Coinhive was a donation ini­tia­tive of UNICEF Australia, where donations were generated through website visits.

If you are wondering whether your device is affected by cryp­to­min­ing malware, you should pay attention to the most common sign to detect malware: an un­ex­plained high CPU or GPU load. Since cryp­to­jack­ers are primarily in­ter­est­ed in computing power, it is difficult to hide the malware’s impact. In order to generate high profits from cryp­to­jack­ing, workload must be cor­re­spond­ing­ly high. This can sometimes reach up to 90 or 100 percent.

No­tice­ably noisy operation of the computer’s ven­ti­la­tion or an over­heat­ed device indicates that processes are running in the back­ground. So, unless you’re running com­pu­ta­tion­al­ly intensive tasks your device shouldn’t overheat. If it does, it may be in­dica­tive of a possible malware in­fes­ta­tion. In the worst scenario, un­de­tect­ed cryp­to­jack­ing can shorten the lifespan of your device due to permanent load and cause higher energy bills.

Those infected by cryp­to­jack­ing Trojans should proceed as they would in case of any other malware in­fes­ta­tion:

Scan your device using a reliable anti-malware software to check whether the malicious program is de­tectable; eliminate the malware. Since cryp­to­jack­ing Trojans can disable antivirus software and in­ac­ti­vate the Task Manager or hide in the registry system files, this method isn’t always suc­cess­ful.

If anti-malware programs cannot detect anything, contact a pro­fes­sion­al IT security expert. You could play it safe by com­plete­ly rebooting your device, e.g., by using Windows Recovery.

You can prevent cryp­to­jack­ing Trojans by keeping your system up to date, in­stalling updates, using a reliable and regularly updated antivirus program, and taking note of sus­pi­cious system behaviors, for example, a device heating up, loud ven­ti­la­tion, and slow pro­cess­ing power.

Since cryp­to­jack­ing does not always infect your system, but also hijacks computing ca­pac­i­ties via Java scripts, ad­ver­tise­ments or streams, illegal mining can be prevented by blocking Java scripts or mining filter lists. Java scripts can then be disabled in any browser. However, this may result in some website func­tion­al­i­ties no longer being ex­e­cutable. Browser ex­ten­sions such as “No Coin” or “MinerBlock” also attempt to directly prevent mining ac­tiv­i­ties in the browser.

It is safer to use holistic security solutions such as My­De­fend­er from IONOS or Mal­ware­bytes, which detect both “classic” malware and mining malware and combat them.

Since cryp­to­jack­ing can damage hardware and lead to data loss, you should regularly back up your data using external media. My­De­fend­er from IONOS is a suitable option offering automatic backups in ISO-certified data centers for double pro­tec­tion and multiple backups. You can back up selected data or entire systems.

Malware can be defined into roughly three cat­e­gories:

• Viruses: Malicious program codes that multiply and ma­nip­u­late and damage systems.
• Worms: A subclass of viruses that ma­nip­u­lates systems, damages them, opens access for ad­di­tion­al malware, overloads computer capacity and, unlike viruses, spreads without user in­ter­ven­tion, for example through emails and spam in networks; a well-known example is Emotet
• Trojans: Malicious program codes that do not reproduce but ma­nip­u­late system functions

As cryp­to­jack­ing shows, the bound­aries between malicious programs are blurry. For example, computer worms often serve to open up access for malicious Trojans and rootkits. The most common functions of malware include:

• Espionage and phishing of sensitive user and access data
• Spreading or down­load­ing further malware, e.g., as part of a botnets
• In­fil­tra­tion to carry out cyber attacks
• “High­jack­ing” of systems to perform targeted tasks
• Over­load­ing of computers and systems due to DDoS and DoS attacks
• En­cryp­tion of data for the purpose of extortion as is the case with ran­somware