Cryptojacking
Steal CPU/GPU resources from victims without awareness to mine cryptocurrency (usually Monero due to CPU-mineable). Peak 2017-2018 via Coinhive JS injection on hacked websites. Container/cloud attacks continue 2024+.
Coinhive: browser-based Monero miner in JS. Embedded on 30000+ hacked websites. Webroot-detected → Coinhive shut down 2019. Modern variant: Docker API exposed online → attacker runs miner container, costs victim thousands in AWS bills. Kubernetes attacks: compromise kube-apiserver, deploy miner DaemonSets. GitHub Actions abuse: free CI/CD minutes used for mining. Detection: anomaly CPU usage, network traffic to mining pools, eBPF-based runtime monitoring (Falco). Crypto-price correlated: bear market → less cryptojacking incentive.