My friend Danish runs a three-person design shop. Last month his office PC started sounding like a hairdryer. He was reading a recipe. Task Manager showed his browser eating about 90 percent of the CPU. No video. No game. Just soup.
That’s what a crypto parasite looks like. It borrows your processor, your power and your patience, mines coins for a stranger, and leaves you the bill. Here’s the core point. Cryptojacking is easy to spot once you know seven signs, and a few free steps stop most of it. Below, I cover how it works, how to check your own machine, and what Danish did about his. I also cover the schemes that go after your wallet instead.
What Is a Crypto Parasite?
I use that name for cryptojacking malware. Someone sneaks code onto your device. The code mines cryptocurrency with your processor. You pay for the electricity. You take the wear on the hardware. They keep the coins. That’s the parasite part. It feeds on a host, and the host never gets a vote. Mining itself is legal. Cryptojacking is the same math, run without permission. Danish learned that the slow way. His fan noise wasn’t a hardware fault. It was somebody else’s business plan.
What is cryptojacking and why call it a parasite?
Cryptojacking is unauthorized mining. A script or program runs on your device and does the heavy math that coin networks pay for. Your device covers the costs. The attacker collects the reward. Smart parasites stay quiet. Careless ones max out your CPU. Danish got a careless one.
Why do attackers favor Monero?
Monero is a privacy coin. Its transactions are built to be hard to trace. It also runs fine on ordinary CPUs, which suits stolen processors. That’s general industry knowledge, not something I measured. Coinhive, the best-known browser miner, mined Monero too.
How Does Cryptojacking Work?
It runs on a simple loop. Get in. Drop the miner. Mine until someone notices. The way in changes. A website script. A shady extension. A phishing link. An exposed cloud server. Some miners throttle themselves so you won’t notice. Some run almost entirely in memory and leave few files behind. I told Danish that sounded like a bad houseguest. He said houseguests at least bring wine. Below are the three places I’d worry about most.
How does browser-based cryptojacking work?
A mining script, usually JavaScript, runs inside your browser tab. No install needed. It hides on a compromised site, a malicious ad or an infected extension. Close the tab and it stops. Coinhive made this easy. It launched in September 2017 and shut down in March 2019. Bad Packets claimed in 2018 that it ran on 62 percent of the sites using browser miners. Its operators said it no longer paid off.
How does it hit cloud servers and Kubernetes?
Through exposed systems and stolen credentials. The attacker spins up miners in your cloud account. You get the bill. Tesla’s case is the classic. In 2018, researchers at RedLock found attackers had reached its AWS account through a Kubernetes console with no password. The lesson is boring. Password-protect your consoles. Then watch your cloud bill. A sudden jump in compute costs is a smoke alarm.
Can phones, smart TVs and IoT devices get infected?
Yes. Android phones and IoT gadgets can run miners too. They’re weak miners, but a few thousand add up. Smart TVs and cheap cameras are the usual victims because they rarely get updates. I checked the firmware date on my own TV that week. Two years old. Oops.
What Are the Warning Signs of Cryptojacking?
Danish’s first sign was the fan. It’s usually the fan. Mining pushes a processor hard, and hardware under load gets loud and hot. The seven signs below follow Bitdefender’s checklist. None proves an infection alone. Each can have boring causes, like a dusty vent. One sign means look closer. Three means act. Spoiler: Danish hit five.
Why is my CPU usage high when nothing is open?
Sign one: high CPU or GPU use while nothing demanding is running. That’s the big one. Sign six sits next to it: an unfamiliar process eating a large share, or odd outbound network traffic. Danish’s browser sat near 90 percent on a recipe page. An idle PC normally sits in the single digits. I checked mine that night. 3 percent. Smug.
Why does my laptop overheat while I browse?
Sign two: loud fans and overheating. Third sign: sluggish apps. Sign four: a battery that melts in an hour. Sign five: random crashes. Danish’s PC hit the fan noise, the lag and one crash. It has no battery, so he missed sign four. He was disappointed.
How do you check Task Manager for a miner?
Open Task Manager. Watch CPU and GPU while you’re idle. Sort by CPU. Search any odd process name online. Sign seven: Task Manager won’t open, or closes itself. Some malware blocks monitoring tools to stay hidden. Treat that as a loud alarm. Danish’s opened fine. His browser led the list.
How Do You Detect, Remove and Prevent It?
Good news first. Most of this is free. Danish fixed his in about an hour. He disconnected the PC, ran a scan, then went through his browser extensions. One had changed hands and quietly updated. Gone. Then he installed a script blocker and patched everything. A home PC needs a scan and a few blockers. A business needs monitoring on top.
What should you do first if you suspect an infection?
Disconnect from the internet first. Run a full scan with a trusted security tool. Update the operating system, the browser and your apps. Remove programs and extensions you don’t recognize. Change passwords if you think the device was compromised. If the miner keeps coming back, restore from a clean backup or reset the PC. Danish skipped the reset. Lucky.
Which blockers and extensions actually help?
Block the scripts. Extensions like uBlock Origin, NoCoin and MinerBlock target mining scripts. Turning off JavaScript on sites you don’t trust helps too, though it breaks half the web. Remove extensions you no longer use. Danish had eleven. He kept four.
How do you protect small-business servers and cloud accounts?
Patch fast. Lock down consoles, use least privilege, and delete accounts nobody uses. Add endpoint detection and response tools. Watch outbound traffic for mining services. Set alerts on CPU spikes and cloud spend.
What Other Crypto Threats Prey on Your Wallet?
Cryptojacking steals your computer. Other schemes steal your coins. Different crime. Same hunger. The FBI’s Internet Crime Complaint Center reported record crypto-related fraud losses for 2025. Coverage of the report put them at about $11.4 billion across more than 181,000 complaints. Victims aged 60 and over lost about $4.4 billion. I read that and called my uncle. He laughed. Then he stopped laughing.
How is cryptojacking different from ransomware?
Ransomware announces itself. It locks your files and demands payment. Cryptojacking stays quiet and wants your processing power. One is a mugging. The other is a squatter. Both can start with a phishing email.
What are wallet drainers and address poisoning?
Wallet drainers are malicious sites or contracts that trick you into signing permissions, then empty your wallet. Address poisoning plants a look-alike address in your transaction history, hoping you’ll copy the wrong one. Check the full address, not just the first and last characters. Revoke permissions you don’t recognize.
Where do you report crypto fraud?
In the US, file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov. Keep wallet addresses, transaction IDs and screenshots. Tell your exchange too. Elsewhere, use your local police or financial regulator. Don’t pay anyone who promises to recover your funds for a fee. Recovery scams are their own category, with about $1.4 billion in reported losses in 2025.
Conclusion
Danish’s PC is quiet now. The fan sits at a polite hum. I stopped by last Friday, and his browser sat at 4 percent on a recipe page. He’d removed the extension, added a blocker, and set a monthly reminder to check Task Manager. That’s all it took. A crypto parasite wins by being ignored. Watch for the fan, the heat and the lag. Check Task Manager. Keep your software updated. Block the scripts. And if a wallet’s involved, read every address in full. Danish still doesn’t trust recipe sites. I don’t blame him.
FAQs
How do I know if my computer is mining crypto?
Look for high CPU or GPU use while idle, loud fans, heat and sluggish apps. Open Task Manager and sort by CPU to find the process. Then run a full malware scan.
Is cryptojacking illegal?
Generally, yes. Mining on someone else’s device without permission is unauthorized use of their computing resources, and most countries treat that as a crime. Mining on your own hardware is usually legal.
Does an ad blocker stop cryptojacking?
It helps. Blockers such as uBlock Origin and NoCoin target mining scripts in the browser. They won’t stop malware installed on your device, so keep scanning and updating too.
How do I remove a cryptojacking script from my computer?
Disconnect from the internet, run a full scan, update your system, and remove unfamiliar programs and extensions. If it keeps coming back, restore from a clean backup.