About cryptojacking

Cryptojacking is a variety of cybercrime which involves using somebody else's devices (computers, tablets, smartphones, and servers) without their owners' knowledge to clandestinely produce (mine) cryptocurrencies, for example, Bitcoin.

How does cryptojacking work

The criminal hacks the device and installs special software that works in the background and does not arouse any suspicion in the user.

The malicious code can be installed in some of the following ways:

• The user follows a phishing link in an email message, which downloads the mining malware to the device.
• The user visits a website which loads what appears to be advertising banners, which run malicious code (JavaScript) when opened.

When the cryptojacking software is installed on the device, the mining begins, that is, generation of cryptocurrency. Mining consumes significant processing power, which negatively affects the functioning of the device.

The danger of cryptojacking

Even though cryptojacking does not directly harm the operating system and user data, it can still present a significant threat. For example, cryptojacking can damage the device or shorten its service life by making it overheat.

How to recognize cryptojacking

The following signs may indicate that cryptojacking is going on:

• Reduced performance of the device. You can suspect cryptojacking if the operating system performance is degraded, applications are running slower, the battery discharges too quickly, or the device shuts down seemingly without reason.
• Device overheating. Cryptojacking consumes a lot of resources, which may cause the device to overheat. Constant noise from cooling fans might indicate that the device is running cryptojacking software.
• Increased CPU load. If you visit a website that does not have any video or audio content, but you still see increased CPU load, it might be evidence of the website running a cryptojacking script. You can see your CPU load in Task Manager on the Performance tab.

How to defend against cryptojacking

Kaspersky application includes tools that can help protect your device from cryptojacking. Websites that you visit are checked for embedded malicious code. If a cryptojacking attempt is encountered, the application displays a notification that lets you delete the malicious code.

Links are checked against a database of phishing web addresses and fake cryptocurrency exchanges, which is regularly updated. If you try following a malicious link, the application displays a warning.

Even if the cryptojacking code makes its way to your device, Kaspersky application detects it as malicious and prevents it from running.

For additional protection, Kaspersky uses heuristic analysis and sends queries to the Kaspersky Security Network (KSN) cloud services during the check. Kaspersky Security Network has the most up-to-date information about emerging threats, including cryptojacking threats.