Inadvertently making cyber criminals rich: A comprehensive study of cryptojacking campaigns at internet scale

Hugo L.J. Bijmans, Tim M. Booij, Christian Doerr

Research output: Chapter in Book/Conference proceedings/Edited volumeConference contributionScientificpeer-review

21 Citations (Scopus)
62 Downloads (Pure)


Since the release of a browser-based cryptominer by Coinhive in 2017, the easy use of these miners has skyrocketed illicit cryptomining in 2017 and continued in 2018. This method of monetizing websites attracted website owners, as well as criminals seeking new ways to earn a profit. In this paper, we perform two large studies into the world of cryptojacking, focused on organized cryptomining and the spread of cryptojacking on the Internet. We have identified 204 cryptojacking campaigns, an order of magnitude more than previous work, which indicates that these campaigns are heavily underestimated by previous studies. We discovered that criminals have chosen third-party software - such as WordPress - as their new method for spreading cryptojacking infections efficiently. With a novel method of using NetFlow data we estimated the popularity of mining applications, which showed that while Coinhive has a larger installation base, CoinImp WebSocket proxies were digesting significantly more traffic in the second half of 2018. After crawling a random sample of 49M domains, ~20% of the Internet, we conclude that cryptojacking is present on 0.011% of all domains and that adult content is the most prevalent category of websites affected.

Original languageEnglish
Title of host publicationProceedings of the 28th USENIX Security Symposium
PublisherUSENIX Association
Number of pages18
ISBN (Electronic)9781939133069
Publication statusPublished - 2019
Event28th USENIX Security Symposium - Santa Clara, United States
Duration: 14 Aug 201916 Aug 2019

Publication series

NameProceedings of the 28th USENIX Security Symposium


Conference28th USENIX Security Symposium
Country/TerritoryUnited States
CitySanta Clara


Dive into the research topics of 'Inadvertently making cyber criminals rich: A comprehensive study of cryptojacking campaigns at internet scale'. Together they form a unique fingerprint.

Cite this