What Is Cryptojacking and How to Detect It in Your Browser

Cryptojacking is when someone secretly uses your computer's processing power to mine cryptocurrency for themselves. You pay in electricity, heat, battery life and a slower computer; they keep the coins.

How it gets into your browser

• Scripts on websites: mining code hidden in a hacked site or a malicious ad runs while the page is open.
• Extensions: an extension that mines in the background. The Chrome Web Store banned mining extensions in 2018, but bad extensions still slip through.
• Malware on the computer: mining software installed outside the browser, often bundled with pirated software.

Browser mining peaked around 2018. Coinhive, the best-known mining script, shut down in March 2019, and in-browser mining is now rarer, but it hasn't disappeared.

Signs to watch for

• Fans running loudly while you're only reading a page.
• The computer getting hot, or the battery draining much faster than usual.
• Everything slowing down when a particular site or tab is open.
• High processor use that continues after closing heavy apps.

Find the culprit

1. Chrome's Task Manager: press Shift + Esc (or Menu → More tools → Task manager). Sort by CPU. A tab or extension using lots of CPU while idle is suspicious.
2. Windows Task Manager or Mac Activity Monitor: check for unknown programs using heavy CPU outside the browser.
3. Close tabs one at a time and watch whether usage drops.
4. Disable extensions one at a time at chrome://extensions if the problem continues with no tabs open.

How to block it

• Close the site and avoid it in future.
• Remove suspicious extensions, especially ones you didn't install or that changed after an update.
• Use a content blocker with lists that block known mining scripts.
• Keep Chrome and your system updated.
• Run your antivirus, which detects most mining malware.
• Firefox blocks known cryptominers as part of its tracking protection.

Related crypto threats

A more damaging attack swaps the cryptocurrency address you copy for the attacker's, so payments go to them. Always check the first and last few characters of an address after pasting. See crypto address swapping.

Clipboard Guard stops web pages from reading your clipboard. It doesn't detect mining scripts, so use the steps above for that. See also drive-by downloads.