A miner-like payload is malware, or suspected malware, that behaves like cryptocurrency mining software. Security teams use the term when a payload consumes unusual CPU or GPU resources, runs persistent background processes, or connects to mining-related infrastructure. In some cases, the exact objective is not confirmed, so the label describes observed behavior rather than a proven mining operation.
This matters because mining payloads are often used for opportunistic abuse after an intrusion: they monetize access without immediately breaking systems, but they can still degrade performance, increase costs, and reveal deeper compromise. Defenders look for sustained high resource usage, unexpected child processes, unknown binaries, and outbound connections to pool-like servers. Blocking execution, restricting privileges, and monitoring for anomalous process and network activity are common ways to catch or stop this type of payload.