A novel cryptojacking campaign exploits Windows' charmap.exe to covertly mine cryptocurrency, initiating via spear-phishing and deploying a custom miner that bypasses traditional antivirus detection, resulting in severe system performance degradation. The attack maintains persistence through scheduled tasks and DLL side-loading, significantly impacting healthcare and education sectors.