Skip to content
XMRig Crypto Miner Discovered on Mac via AI Temperature App

XMRig Crypto Miner Discovered on Mac via AI Temperature App

First seen 19 Oct 2026, 23:20 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 19, 2026 at 23:51 UTC
  • •XMRig miner consumed 1,175% CPU on a Mac, indicating severe resource theft.
  • •The miner was detected by Claude Code while developing a temperature-monitoring app.
  • •Infection method remains unclear; user speculates cracked audio plugins may be involved.

Anthropic's Claude Code AI agent detected a hidden XMRig cryptocurrency miner on a user's Mac while developing a temperature-monitoring app. The miner was consuming 1,175% CPU, indicating nearly 12 cores were fully utilized, and caused the system to reach a peak temperature of 112°C. The user, identified as u/UntilHEX, initially noticed unusual sensor readings and asked Claude to verify the accuracy. The miner, which is often associated with cryptojacking, was found running from a temporary folder and mining to a pool at pool.hashvault.sh. The exact method of infection remains unclear, although the user speculated it could be linked to cracked audio plugins. Despite Apple’s built-in protections like XProtect and Gatekeeper, the modified miner managed to bypass these defenses. After Claude prompted the user for permission, they successfully quarantined the miner with minimal manual intervention. The incident highlights ongoing risks associated with pirated software on macOS.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-19
XMRig miner discovered
Claude Code AI identified a hidden XMRig miner on a user's Mac, causing high CPU usage and temperatures.
Cyberkendra
2026-10-19
User confirms cleanup
After Claude's intervention, the user quarantined the miner and ran a Malwarebytes scan to verify system cleanliness.
Wccftech

More articles in this cluster (2)

Following this threat?

Track XMRig in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (3)

1 / 2

Common questions

How did the miner evade detection?
The miner likely bypassed Apple's XProtect and Gatekeeper due to being a modified or repackaged binary.
What steps should I take if affected?
Users should run a thorough malware scan and check for unauthorized processes, particularly if using cracked software.
Is XMRig a legitimate software?
XMRig is an open-source miner for Monero but is often used in cryptojacking scenarios.