A cryptocurrency miner is software that uses a computer’s CPU, GPU, or memory to generate digital currency. In legitimate mining, the owner consents and the workload is expected. In cyber attacks, the same kind of code is installed without permission and runs in the background, consuming power and slowing the host.
Miners matter because they are a common form of post-compromise abuse: once attackers gain access, they deploy mining software to turn someone else’s server into a source of profit. On exposed servers, miners often appear alongside web shells or other persistence tools. Defenders look for unusual CPU spikes, unexplained outbound connections, new scheduled tasks or services, and unfamiliar binaries. Blocking internet exposure, patching entry points, and monitoring host behavior help prevent resource hijacking.