How to Detect Cryptojacking on Dispatch, POS and Driver Devices

The awkward thing about cryptojacking is that it does not announce itself. Ransomware puts a note on your screen. A card scam shows up as a chargeback. A miner just sits there, using your processors to make cryptocurrency for someone else, and the only evidence is that your equipment feels worse than it used to.

Which is why it gets missed for months in small operations. The order terminal has been slow “for a while”. The laptop that builds the route runs hot, but it is three years old. A driver’s phone dies at lunchtime, and everyone assumes the battery is going. Individually, each one has an innocent explanation. Together, they are the classic profile of a machine that has been mining since spring.

This is the diagnostic guide: how to detect cryptojacking on the machines a delivery day depends on, using checks you can run yourself in an afternoon. If nothing turns up and you want to keep it that way, the companion piece covers the controls that stop it happening: how to prevent cryptojacking attacks when you deliver your own orders.

The Bottom Line

• The tell is sustained high processor usage when nothing is running. Everything else follows from that: heat, noise, slowness, battery drain.
• Check when the shop is closed. An idle machine at 70% is a much clearer signal than a busy one at 70%.
• Some miners hide from Task Manager. They pause when you open it, so watch the fan and the temperature as well as the numbers on screen.
• The bills are a detector too. A power bill or a cloud invoice that moved without a reason gets ten minutes of checking.
• The cost is lopsided. Sysdig’s research found victims lose roughly $53 for every $1 a cryptojacker earns, so a miner that looks like a minor nuisance is not one.
• Finding a miner means finding a way in. Removing the software without closing the hole gets you a reinfection.

The signs of cryptojacking you can spot without any tools

Before you open anything technical, walk the building. These are the symptoms that reliably show up first, and you already know what your equipment normally sounds like.

• Fans running hard on a machine doing nothing. The most quoted symptom, and the most reliable. A back-office PC with one browser window open should be quiet.
• Heat. A laptop too hot to keep on your knees, a tablet in the van that is uncomfortable to hold, a terminal warm to the back of the hand.
• Everything slower, especially at peak. Mining takes the processor cycles your order system wanted. It is worst at the time you can least afford it.
• Phone batteries dying by lunchtime. On delivery phones this is often the very first sign, because there is nothing else on the device to blame.
• Machines crashing or rebooting on their own. Sustained full load makes unstable hardware fall over.
• A power bill that moved without an explanation. Not conclusive on its own, but a reason to look.
• A cloud invoice that jumped. If you host anything, this is the loudest signal you will get, and it arrives in dollars.

None of these proves cryptojacking on its own; old hardware and a full hard drive produce similar complaints. Two or three together, on a machine that used to be fine, justify the next hour of your time.

Check processor usage the right way, on Windows and Mac

The real test is simple: what is the processor doing when the business is not asking it to do anything?

On Windows, press Ctrl + Shift + Esc to open Task Manager and go to the Performance tab, then Processes. On a Mac, open Activity Monitor from Applications, then Utilities, and click the CPU tab. Either way, you are looking for two things: the total percentage, and which process is responsible for it.

Do it under the right conditions, or the result means nothing:

• Close everything a person opened. Browser, email, the order system, the accounting tab someone left running since March.
• Give it two minutes. Machines are busy right after you close things.
• Check outside trading hours if you can. An idle machine sitting at 60 to 100% is the finding. The same number during the lunch rush is just a busy computer.
• Watch it for a while rather than glancing. Miners often throttle, running hard in bursts rather than flat out, precisely so they look less obviously wrong.

A machine that is essentially idle and still burning most of its processor is not normal, whatever its age. That is the point at which you go looking for the process behind it.

Find the mining process, and what to do when it hides from Task Manager

Sort the process list by processor usage, highest first, and read the names at the top. You are looking for something you cannot account for: a name you do not recognise, a name imitating a system file with a character out of place, something running from a temporary or downloads folder, or a process with no publisher listed.

Search the exact process name before you act on it. Plenty of legitimate system processes look alarming and use a lot of processor time. Windows Update, indexing services and antivirus scans all spike for good reasons, and killing the wrong one breaks something you need.

Then the complication. Some mining malware watches for exactly this check and pauses when Task Manager or Activity Monitor opens, so the numbers you see look fine while the fan carries on roaring. Two ways around it:

Leave the monitoring tool open and minimised for a few minutes, then bring it forward and look at the graph history rather than the instant figure; a sawtooth pattern that drops every time you look is itself the evidence. Or ignore the software entirely and use your ears and hands: a machine that is quiet and cool while you are watching it and loud and hot when you are not has told you what you need to know.

Check whether a browser tab is doing the mining

A large share of cryptojacking never installs anything. The mining runs in JavaScript inside a page, sometimes the site’s own doing and more often an ad loaded onto an otherwise respectable site, and it stops the moment the tab closes. On a shared back-office machine that keeps a supplier portal open all day, that tab can mine for eight hours at a time.

Chrome and Edge have their own task manager: press Shift + Esc, and you get a per-tab and per-extension breakdown of processor use. Firefox offers the same view at about:performance. A single tab eating 30% or more of the processor while displaying a mostly static page is your answer.

Extensions deserve the same look. They show up in that same list, and an extension mining in the background is one of the harder versions to notice, because closing tabs does not stop it. If a browser’s processor use only settles when you quit the browser completely, work through the extension list and disable them in batches until the number drops.

Watch the network for traffic to mining pools

Mining is not a solo activity. The software has to talk to a mining pool to receive work and submit results, which means a cryptojacked machine keeps up a steady, chatty connection to somewhere it has no business talking to.

For most small operations, this check is one of two things. If your router or firewall keeps a connection log, look for a device holding repeated connections to unfamiliar addresses at regular intervals, including overnight. If it does not, this is the point where an IT provider earns their fee: detecting connections to known mining pools is standard practice for them and takes minutes with the right tool.

The pattern that gives it away is persistence. Ordinary business traffic follows your trading hours. Mining traffic does not care what time it is, which is why the 3am slice of a connection log is the most useful thing in it.

Check delivery phones and tablets for hidden mining

Mobile devices need their own pass, and they are easy to skip because they are never in the building when you are doing the audit.

On Android, open Settings, then Battery, and look at usage by app. An app you do not recognise consuming a large share while you were not using it is the flag. On iPhone, Settings, then Battery, shows the same breakdown, with background activity split out. On both, check the installed app list for anything nobody can account for, and remove sideloaded apps that did not come from the official store.

The symptoms on a phone are blunter than on a computer: hot in the hand, battery gone by early afternoon, and a device that stutters when the maps app redraws. If a driver mentions any of those about a phone that used to be fine, take it seriously rather than filing it as a complaint about an old handset.

Work out what the miner has already cost you

Two bills tell you how long this has been going on. Pull both before you clean anything up.

Electricity first. A handful of machines held at full load around the clock draws meaningfully more than the same machines idling, and if your bill stepped up in a particular month and stayed there, that month is a good guess at when the infection started.

Then the cloud, if you use any hosted infrastructure, which is where the money is. Sysdig’s threat research team costed one campaign and found the attackers’ $8,100 in mined cryptocurrency had cost their victims over $430,000 in compute charges, a ratio of about $53 lost for every $1 gained. Amazon’s security researchers have documented campaigns that get from stolen credentials to running miners in under ten minutes, so the meter can start long before anybody notices.

And there is a cost that is not on any invoice. Whoever put mining software on your machine had enough access to put anything there. Verizon’s 2026 Data Breach Investigations Report found exploited vulnerabilities have overtaken stolen credentials as the leading way in, and that the same footholds get reused. A miner is often the quietest thing that could have been installed, not the worst.

Tools that detect cryptojacking on a small-business budget

You can find most infections with what you already own, but three categories of tool make it quicker and more certain.

Reputable security software with a full-system scan is the first stop. Mining families are well known to the major vendors, and a scan will name and quarantine most of them. Run it on every machine, not just the one that prompted the search.

Browser blockers are diagnostic as well as preventive. If a site’s processor use collapses the moment a script blocker is switched on, mining scripts were what the processor was working on.

Network monitoring, through your router’s logs or an IT provider’s tooling, is the layer that catches what antivirus misses, because the mining traffic still has to leave the building even when the software hiding it is new.

Watch out for a specific trap here: searching for “cryptojacking remover” and installing the first download. Fake security tools are themselves a common way miners get installed. Stick to vendors you have heard of, and download from the vendor’s own site.

What to do once you have confirmed a miner

Do these in order, because the order matters more than the speed.

Disconnect the machine from the network, but leave it on if you can, because a technician can learn a lot from what is still running. Change the passwords for every account that machine was signed into, doing it from a clean device. Run a full scan and quarantine what it finds, then decide honestly whether a wipe and reinstall beats a cleanup; on a terminal with nothing unique stored on it, rebuilding is usually the faster afternoon and the only one that leaves you certain.

Then check the cloud and payment accounts that machine could reach, revoke any access keys it held, and turn on a billing alert so the next surprise arrives as a notification rather than an invoice.

Finally, close the door that let it in, because removing the software without doing this buys you a few quiet weeks and then the same problem. The unpatched router, the bad attachment, the shared password, the downloaded tool: one of them was the route. The full set of controls is laid out in the guide to preventing cryptojacking attacks, and the hour after a confirmed infection is the easiest hour you will ever have to get them implemented.

Frequently asked questions

How can I tell cryptojacking apart from an old, slow computer?

Age makes a machine slow all the time; a miner makes it busy when it should be idle. Check the processor with everything closed and, ideally, after hours. Consistently high usage with no process you can name is the distinguishing signal, and heat and fan noise on an idle machine back it up.

Will antivirus software always detect cryptojacking?

No. It catches known mining families reliably, and misses browser-based mining and freshly written variants more often than vendors like to admit. Pair a scan with a manual processor check and, where you can, a look at network traffic.

Can cryptojacking affect a point-of-sale terminal?

Yes. Anything with a processor and a network connection is a candidate, and POS terminals are attractive because they are always on, rarely inspected, and often running older software. A terminal that has become sluggish deserves the same check as a laptop.

How long does cryptojacking usually go unnoticed?

Longer than owners expect, because the symptoms all have innocent explanations. Businesses often trace the start back to a billing change months before anyone connected the slowness, the heat and the noise to a single cause.

Should I report a cryptojacking incident?

Yes, if there is any sign the attacker reached customer data or payment systems, and in the US that means the FBI’s IC3 as well as your payment processor if card systems were involved. Even without a data loss, tell whoever supports your IT, because the entry point they find usually affects more than one machine.