Cryptojacking
Cryptojacking is the unauthorised use of someone else’s computing resources to mine cryptocurrency. In cloud environments it is usually the visible symptom of a compromised credential rather than the objective itself, which makes an unexplained rise in compute spend a cheap and reliable intrusion sensor.
The sequence is consistent. An access key is found in a public repository, a container platform is exposed without authentication, or a workload is reachable and unpatched. The attacker then does the fastest thing that turns access into money: start compute in every region the account permits, sized for whatever the quota allows. Nothing about the activity is subtle, because subtlety costs the attacker revenue.
What makes it worth taking seriously is what it implies rather than what it costs. The credential that started instances could have read the data, altered the infrastructure or created a persistent identity, and mining is simply the option that pays immediately. Treating the bill as the incident and rotating the key without establishing what else that identity touched is the mistake we see most often afterwards.
Detection is available to everyone at no cost: spend anomalies by region and service, quota increase requests, and compute started outside the deployment pipeline. Prevention is the same set of controls that address a cloud misconfiguration generally, with the retirement of every long-lived access key doing most of the work. Those are the same paths we follow in the cloud testing that follows the same paths a miner would.