Cryptojacking
In plain terms
Your device is computing for someone else, to produce cryptocurrency. Nothing is stolen from your files: it's electricity, speed, and the hardware's lifespan that get consumed.
Definition
Cryptojacking is the unauthorized use of your device's computing power to produce cryptocurrency for a third party's benefit. It differs from other malware in what it targets: neither your data nor your accounts, but a hardware resource.
How it works
Two forms coexist. The first is an installed program that runs in the background and restarts at boot. The second runs inside the browser, triggered simply by visiting a page or through an extension, and stops when the tab closes — which explains why a computer can heat up on some sites and not others. The computation keeps the processor busy continuously, hence the heat, the fans, the general slowness, and, on a laptop or phone, a battery life that collapses. Well-designed programs throttle their consumption while you're using the machine and speed up once you leave it idle, which makes the symptom harder to trace to a cause. The harm is real though indirect: power consumption, accelerated wear, and, on a phone, a battery that ages quickly.
Warning signs
- Noisy fans and a hot device while you're doing nothing demanding
- General slowness that disappears when you close the browser or a specific tab
- Very reduced battery life, phone warm in your pocket
- Processor heavily used at rest, by a process whose name means nothing to you
- Electricity bill rising with no change in equipment, for a device left switched on
How to verify
Open the task manager or activity monitor and see what's using the processor at rest. Then close the browser: if the load drops immediately, look at a tab or extension rather than an installed program. This is one of the few entries in this family where checking from the machine itself is conclusive, since the method has no interest in hiding to the point of giving up the computation.
What to do
Review your browser's extensions and remove any you don't use — it's the most common vector for the browser form. Keep the browser and the system updated. Don't leave tabs permanently open from sites of unknown origin.
If it already happened
Identify the responsible process or tab and remove whatever installs it: extension, program, page left open. If the load returns after a restart with no browser open, it's an installed program, often bundled with another one — treat the machine as more broadly compromised, and change from another device the passwords that were stored on it. Report the incident to cybermalveillance.gouv.fr.
Frequently asked questions
- Is it really serious if nothing is stolen?
- The harm is material: electricity paid for, hardware worn out faster, a slowed-down device. But the more important question is the entry path: if a program managed to install itself to mine, that same path remains available for something else.
- Is closing the tab enough?
- For the browser form, yes, and that's what sets it apart. If the processor load doesn't drop with the browser closed, or comes back after a restart, it's an installed program and closing the tab changes nothing.
Related attacks
Official sources
Also known as: hidden mining, malicious cryptomining, cryptojacking, hidden mining malware.
This article is part of the Malware family. Last updated: 2026-09-03.