A Monero miner is software that uses a device’s CPU or GPU to solve proof-of-work calculations and earn Monero cryptocurrency for the operator. Unlike destructive malware, miners are often chosen because they can run quietly in the background while generating recurring profit. Monero is especially attractive to attackers because its mining algorithm is designed to work well on common processors, including the CPUs found in many laptops, desktops, and servers.
In cyber security, a Monero miner is a strong sign of unauthorized code execution. Attackers commonly install miners after exploiting a remote service, weak credentials, or an unpatched vulnerability, then try to stay hidden by reducing visible activity. Defenders look for sustained high CPU usage, unfamiliar processes, odd startup items, and unexpected network connections to mining pools. Blocking the initial access path, patching exposed systems, and monitoring for resource abuse are key ways to stop this kind of intrusion.