Skip to main content

Cryptojacking turns your PC into a Bitcoin mine, but you won’t see a cent

Image used with permission by copyright holder

(in)Secure is a weekly column that dives into the rapidly escalating topic of cybersecurity.

Cryptocurrency has fought for its reputation ever since its creation. Bitcoin fans have always had to defend against accusations that it’s only purpose is for illicit activities — that it’s a currency for criminals. Bill Gates even argued it has caused death in his recent Reddit AMA.

Now, cryptocurrency has yet another problem to deal with: cryptojacking. It’s the act of hacking a computer for use in cryptocurrency mining, usually without the owner knowing about it. It’s the newest evolution of malware — and it looks set to spread like wildfire.

A brave, new world

In February, Salon announced a new crowdfunding campaign that caught headlines across the internet. You can donate your computing power through cloud mining to help support the publication. It doesn’t require the installation of software, or even setting up an account.

Just like that, an alternative to paid subscriptions and ad-based revenue has appeared. Cloud mining was already catching on, and now it’s finding new, interesting use cases.

Also in February, security researcher Scott Helme published his findings on the dark side of the technology. Without getting consent from either the owner of the website or visitors, cryptocurrency scripts can be hacked into websites, which then hack visitor’s CPU power. That’s cryptojacking.

The past year has witnessed several large-scale attacks on websites like the LA Times, Tesla, and Politifact, but recently the trend has escalated in an even more startling way. Research shows that thousands of legitimate websites, including some that belong to government institutions, have been cryptojacked.

How? Helme puts it this way: “If you want to load a cryptominer on 1,000+ websites, you don’t attack 1,000+ websites, you attack the one website that they all load content from.” In one case, an assistive technology called Text Help was compromised. Any website that used it then cryptojacked visitors, without either the website owners or visitors having a clue.

Another recent report claims 50,000 websites already have crypto-mining malware ready to steal your computer’s power without your knowledge. Seven thousand websites have been discovered to contain this strain of cryptojacking on the WordPress platform alone.

Both Salon and the hackers behind recent attacks use the same tool — a JavaScript miner called CoinHive. It can be embedded on a webpage and functions in the visitor’s browser window. Hackers have taken the script and implemented it to immediately force visitors to donate their CPU power toward mining Monero coins, or XMR. (What’s that, you ask? Read our guide to the best Bitcoin alternatives).

The internet could become one big, illicit crypto-mining operation.

That wasn’t CoinHive’s intent. Instead, its developers “dream about it as an alternative to micro payments, artificial wait time in online games, intrusive ads, and dubious marketing tactics.” It’s a rather clever idea, really. The average PC is much more powerful than needed to browse the web, so why not use a bit of that performance to pay for content? The creators of CoinHive told Motherboard recently that “their reputation couldn’t be worse,” lamenting that they didn’t see the potential of cryptojacking at the time.

To be clear, cryptojacking isn’t an easy way for hackers to get rich. If a site has 10–20 active miners all day, CoinHive claims “you can expect a monthly revenue of about 0.3 XMR (~$86).” It’s relatively easy for hackers to implement, however, and the anonymous nature of cryptocurrency makes the payoff hard to trace. Consider it low reward, but very low risk. So long as cryptocurrencies keep rising in value, cryptomining — and its dark side, cryptojacking — will continue to spread.

This is only the beginning

It’s not hard to imagine cryptojacking’s future. Today, ads are everywhere you look on the internet, and off. Ads appear everywhere from YouTube to free software. Cloud cryptomining could provide an alternative, letting you “donate” some processor power for free web content or software.

We could also see a future where cryptojacking is constantly in the news — and in much greater potency. The internet could become one big illicit crypto-mining operation, and the fight against that won’t be easy. Hackers will find efficient and more subtle ways of secretly contorting innocent CPUs to make a quick buck. Right now, it’s not yet possible to mine cryptocurrency in-browser using a visitor’s GPU, which would provide much more substantial hashing power. Such a thing can’t be too far away.

Image used with permission by copyright holder

And it doesn’t stop with in-browser mining.

Imagine the way adware works today. You’re installing a piece of software, and you quickly click through a few checkboxes to complete the installation. Without being fully aware of it, you’ve installed a piece of software that generates revenue for a company by inserting ads into your browser. Because it’s invisible, cryptojacking malware tougher to deal with. You might not even notice it quietly humming along in the background as it slows your computer and fills someone’s crypto-wallet.

This is certain to happen in a future where cryptocurrency cements its position as an online currency. It’ll give developers and website owners a new way to make legitimate cash from their work — and profit-driven hackers another potent tool in their toolbox.

Editors' Recommendations

Luke Larsen
Luke Larsen is the Senior editor of computing, managing all content covering laptops, monitors, PC hardware, Macs, and more.
The best password managers for Mac
Login screen on a MacBook.

Picking out a safe and reliable password manager can be hard. You want the features you need, excellent security, an intuitive interface, simple setup, and an affordable price. To help you choose the right tool for you, we have a list of the best password managers for Mac.

Keep in mind that Apple’s dedicated Password app arrives with MacOS Sequoia in fall 2024.
Bitwarden Password Manager

Read more
Best Dell laptop deals: Cheap laptops starting at $400
The Dell XPS 13 9315 on a table against a window.

Dell is one of the best laptop brands on the market, and it has an absolute ton of variety when it comes to laptops, whether you want general day-to-day laptops or even something more specific like gaming laptops. In fact, Dell even offers a few great budget laptops if you don't need anything fancy, which is why going for a Dell makes a lot of sense regardless of what sort of budget or power needs you have.
Of course, having so many options can be a bit overwhelming for somebody who isn't familiar with Dell or the laptop market, which is why we scoured the Dell website and other retailers for our favorite picks and listed them below. This list has a lot of crossover with the best Dell XPS deals, student laptop deals and gaming laptop deals, so make sure to check out some of those other great laptop deals as well.

Dell Inspiron 15 -- $400, was $550

Read more
Best gaming laptop deals: Alienware, Razer, Asus and more
An Alienware m16 gaming laptop in use on a desk, playing Baldur's Gate III.

Modern gaming laptops are sleek, lightweight, and surprisingly powerful, given the first two parts, especially with how big modern GPUs tend to be. In fact, some of the best gaming laptops can match, or at the very least, compete with some of the best gaming desktops, which is pretty impressive given their size. You'll also be happy to know that the best PC games still manage to work well with lower and mid-range modern gaming PCs, so you don't have to worry about spending several thousand dollars to get something that's good at gaming.

To help you with picking something great, we've found deals from some of the best laptop brands and include Lenovo laptop deals, Acer laptop deals, Dell laptop deals, and HP laptop deals, although if you're looking for some more general deals, these laptop deals have some good options, too.
MSI Bravo 15 -- $750, was $1,000

Read more