← Back to Blog

Cloud Security · 5 min read · September 23, 2026

What Is Cryptojacking and How Do You Detect It in 2026?

Cryptojacking is the unauthorised use of your computing power to mine cryptocurrency — and in 2026 the targets are cloud accounts, containers, and exposed DevOps tooling, not just desktops. Here is how the attacks land, how to confirm a miner on a Linux server or in the cloud, and the hardening steps that close the door.

What Is Cryptojacking?

Cryptojacking is the unauthorised use of your computing power to mine cryptocurrency. Instead of encrypting files or stealing data, the attacker plants a miner and lets your CPU, your electricity, and your cloud bill pay for their profit.

The coin of choice is almost always Monero (XMR), because it is designed for CPU mining and its privacy features make proceeds hard to trace. That economics is why cryptojacking rarely announces itself — no ransom note, no exfiltration, just a server running hot.

Why Cryptojacking Surged in 2026

Three shifts turned resource hijacking from a nuisance into a mainstream cloud threat.

• Cloud is the default target. SentinelOne logged USD 6.5 million in cryptojacking incidents in early 2026 alone, after roughly 136% growth in recent years. The same research found 154% more organisations suffered a major cloud breach year over year.
• AI and DevOps tooling is the new front door. Trend Micro documented exploitation of CVE-2026-33017 in Langflow to deploy a customised XMRig miner with RandomX proof-of-work and cron persistence.
• Containers are cheap to abuse. A single unauthenticated API call can start a mining container, and the victim pays for the compute.

How Attackers Get In

Cryptojacking is rarely an exotic exploit. It is a search-and-scale operation against the most common exposures:

• An exposed Docker daemon API. Wiz tracked a campaign (JINX-0132) against publicly reachable Docker, Nomad, Consul, and Gitea servers. One POST to /containers/create with the host filesystem bind-mounted is effectively root.
• Unsecured Kubernetes and DevOps tooling. Open dashboards, permissive RBAC, and unauthenticated control planes.
• Unpatched internet-facing apps. Confluence CVE-2023-22527 and the Langflow flaw were both used to drop XMRig.
• Leaked secrets. GitGuardian counted 28.65 million new hardcoded secrets on public GitHub in 2025 — a leaked cloud key or environment file is enough to spin up instances in your account.
• Supply chain. The TeamPCP actor, linked to 2026 compromises of tooling including Trivy and LiteLLM, escapes containers in under a minute to establish persistence.

What an Infection Looks Like in the Wild

Once inside, XMRig-family miners are engineered for quiet:

• Persistence through cron and systemd. Small crontab drops and new service units survive reboots.
• Competitor killing. Miners terminate other miners to own the CPU they just stole.
• Tunnelling and C2. ngrok, frp, socat, DNS TXT records, and DNS-over-HTTPS keep pool and command traffic off obvious blocklists.
• Deliberate throttling. In the Tesla cloud case the attacker capped CPU to stay under monitoring thresholds; the activity was only found by an external cloud audit.
• Unmonitored regions. Attackers deploy into unused cloud regions (MITRE T1535), where threat detection is often never enabled.

How to Detect Cryptojacking on a Linux Server

Sustained CPU usage you cannot explain is the headline symptom. Confirm it with five checks:

• ps aux --sort=-%cpu | head — look for unfamiliar binaries and random-looking names such as kdevtmpfsi, kinsing, or xmrig.
• ls -la /tmp /var/tmp /dev/shm — dropped executables, and a config.json holding pool URLs or a wallet address, are a strong signal.
• crontab -l for every user plus ls -la /etc/cron.* — short, recently added job lines are common persistence.
• systemctl list-units --type=service --state=running and ls /etc/systemd/system — new units are the other half of that persistence pair.
• ss -tp — outbound connections to mining pool ports such as 3333, 5555, 7777, and 14444.

Treat any confirmed miner as a full compromise: the same access can read credentials and move laterally.

How to Detect It in Cloud and Containers

On-host checks miss attackers who never persist visibly to your filesystem. Layer these instead:

• Runtime security (Falco, Sysdig, Elastic, Aqua, or your provider's agent) with rules for crypto-mining behaviour, unexpected curl/wget from web servers or containers, and systemd changes originating inside a container.
• Posture scanning for internet-exposed Docker and Kubernetes APIs and over-permissive IAM roles — the entry point, not just the symptom.
• Detection in every region. Enable GuardDuty, Defender for Cloud, or equivalent across all regions, including ones you do not use.
• Cost anomaly alerts. A sudden compute or CPU-credit spike is one of the most reliable cryptojacking signals you own.

How to Prevent Cryptojacking

1. Never expose the Docker daemon API or a Kubernetes control plane to the internet; bind to a socket or firewall it.
2. Patch internet-facing applications quickly, prioritising CISA KEV entries.
3. Enforce least-privilege IAM with short-lived credentials, and scan for hardcoded secrets in code and CI.
4. Run containers with a restricted security context — no privileged mode, no host paths, resource limits applied.
5. Keep data egress visible; mining traffic has to reach a pool.
6. Scan your external attack surface continuously so exposed services are found before they are used.
7. Have a response plan: isolate the host, capture a disk image, remove the miner and its persistence, rotate every credential it could reach, then rebuild from a clean image.

Resource hijacking is a symptom. The real finding is the exposed service or unpatched application that let the attacker in at all.