Cryptojacking occurs when an attacker exploits cloud resources to mine cryptocurrency without the owner's consent. This typically results in high CPU utilization across multiple VMs while keeping network usage relatively low, as mining operations are CPU/GPU-intensive but do not require significant network bandwidth. The cloud engineer should investigate running processes and check for unauthorized mining activities.