# SoK: Cryptojacking Malware

arXiv: https://arxiv.org/abs/2103.03851 · HTML: https://mlsanity.com/paper/2103.03851/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 5 Mar 2021.

## Built on by (most cited first, 4 of 4)

- [The Design Principle of Blockchain: An Initiative for the SoK of SoKs](https://mlsanity.com/paper/2301.00479/) (2023)
- [Targeted and Troublesome: Tracking and Advertising on Children's Websites](https://mlsanity.com/paper/2308.04887/) (2023)
- [DNS based In-Browser Cryptojacking Detection](https://mlsanity.com/paper/2205.04685/) (2022)
- [Clean Up the Mess: Addressing Data Pollution in Cryptocurrency Abuse Reporting Services](https://mlsanity.com/paper/2410.21041/) (2024)

## Abstract (arXiv)

Emerging blockchain and cryptocurrency-based technologies are redefining the way we conduct business in cyberspace. Today, a myriad of blockchain and cryptocurrency systems, applications, and technologies are widely available to companies, end-users, and even malicious actors who want to exploit the computational resources of regular users through textitcryptojacking malware. Especially with ready-to-use mining scripts easily provided by service providers (e.g., Coinhive) and untraceable cryptocurrencies (e.g., Monero), cryptojacking malware has become an indispensable tool for attackers. Indeed, the banking industry, major commercial websites, government and military servers (e.g., US Dept. of Defense), online video sharing platforms (e.g., Youtube), gaming platforms (e.g., Nintendo), critical infrastructure resources (e.g., routers), and even recently widely popular remote video conferencing/meeting programs (e.g., Zoom during the Covid-19 pandemic) have all been the victims of powerful cryptojacking malware campaigns. Nonetheless, existing detection methods such as browser extensions that protect users with blacklist methods or antivirus programs with different analysis methods can only provide a partial panacea to this emerging cryptojacking issue as the attackers can easily bypass them by using obfuscation techniques or changing their domains or scripts frequently. Therefore, many studies in the literature proposed cryptojacking malware detection methods using various dynamic/behavioral features.