Claude Code reportedly finds hidden XMRig cryptominer on a Mac at ~1,175% CPU, persisting via LaunchAgent
A Mac user (Reddit u/UntilHEX) reported that Anthropic's Claude Code found an unauthorized XMRig cryptominer while helping build a temperature-monitoring app. Abnormally high sensor readings led the assistant to inspect running processes and identify XMRig as the cause of roughly 1,175% CPU use, or nearly 12 saturated cores. The finding is a user-reported account with no independent forensic verification. The initial infection vector is unknown; the user suspected cracked audio plugins, but no installer, delivery chain or threat actor has been confirmed. The case shows that troubleshooting can surface cryptojacking, but it does not show that Claude Code can replace dedicated endpoint security.
Technical Details
- The miner reportedly ran from a temporary directory and connected to the mining pool pool.hashvault.sh.
- Persistence was reportedly a macOS LaunchAgent that ran an encoded script at user login.
- The LaunchAgent's KeepAlive setting would restart the process after termination, so killing the visible process would not remove the persistence.
- CPU readings above 100% are normal for multithreaded processes in macOS process accounting, where each fully used core counts as about 100%.
- XMRig is legitimate open-source software; the issue is its unauthorized deployment (cryptojacking).
Remediation
- Remove the malicious LaunchAgent and its encoded script, not just the mining process. The user reportedly approved a cleanup after the discovery.
- Check for the temporary-directory binary and for connections to the mining pool.
- Avoid cracked software, which the user suspected as the source but which is unconfirmed.
Linha do tempo
-
Claude Code reportedly finds hidden XMRig cryptominer on a Mac at ~1,175% CPU, persisting via LaunchAgent
ler a análise desta fonte ocultar
A Mac user (Reddit u/UntilHEX) reported that Anthropic's Claude Code found an unauthorized XMRig cryptominer while helping build a temperature-monitoring app. Abnormally high sensor readings led the assistant to inspect running processes and identify XMRig as the cause of roughly 1,175% CPU use, or nearly 12 saturated cores. The finding is a user-reported account with no independent forensic verification. The initial infection vector is unknown; the user suspected cracked audio plugins, but no installer, delivery chain or threat actor has been confirmed. The case shows that troubleshooting can surface cryptojacking, but it does not show that Claude Code can replace dedicated endpoint security.
Technical Details
- The miner reportedly ran from a temporary directory and connected to the mining pool pool.hashvault.sh.
- Persistence was reportedly a macOS LaunchAgent that ran an encoded script at user login.
- The LaunchAgent's KeepAlive setting would restart the process after termination, so killing the visible process would not remove the persistence.
- CPU readings above 100% are normal for multithreaded processes in macOS process accounting, where each fully used core counts as about 100%.
- XMRig is legitimate open-source software; the issue is its unauthorized deployment (cryptojacking).
Remediation
- Remove the malicious LaunchAgent and its encoded script, not just the mining process. The user reportedly approved a cleanup after the discovery.
- Check for the temporary-directory binary and for connections to the mining pool.
- Avoid cracked software, which the user suspected as the source but which is unconfirmed.