A processing system of a device having at least one processor may determine that a temperature of the device exceeds a threshold temperature and obtain, in response to the determining, utilization information of the device comprising: processor utilization information, memory utilization information, and network utilization information. The processing system may then detect, from the utilization information of the device, a pattern comprising: a first network utilization burst, a processor utilization exceeding a processor utilization threshold and a memory utilization exceeding a memory utilization threshold over at least a designated period of time following the first network utilization burst, and a second network utilization burst after at least the designated period of time. When the pattern is detected, the processing system may generate an unauthorized cryptomining alert.