Developer's Computer Secretly Mined Cryptocurrency for Nearly Two Months

A developer under the nickname UntilHEX discovered that his Mac computer had been secretly mining cryptocurrency for almost two months. The malicious program was detected by the AI agent Claude Code from Anthropic. Previously, the enthusiast used the assistant to create an application for monitoring the computer's temperature. The reason for the check was the sensor readings: UntilHEX uploaded raw data from the Mac sensors and doubted their plausibility, as the values seemed too high to him. Claude Code analyzed the indicators and reported that the peak processor temperature indeed reached 112 degrees Celsius.

The cause of the overheating was constant high load. The agent found out that an external process was consuming the chip's resources. In a message, Claude Code indicated that a cryptominer was running on the Mac, which he did not install, and noticed xmrig using about 1175 percent of the processor's resources, which is approximately 12 cores. In macOS system monitors, a value of 100 percent corresponds to full load on one core, so a value of 1175 percent means the program was utilizing almost 12 cores at maximum. The exact configuration of the Mac is unknown, but it is quite possible that all processor cores were used for cryptocurrency mining.

XMRig is a popular open-source program for cryptocurrency mining, originally created for Monero (XMR). The program itself is legal, but attackers regularly embed it in malicious software. Monero is valued for the anonymity of transactions, and the RandomX algorithm allows for efficient mining of coins on regular central processors without expensive graphics cards.

Judging by the screenshot of the Claude Code window, the malicious element was added to the Mac's startup list as early as August 29, 2026. It is likely that after the infection, UntilHEX decided to write his own application to monitor the temperature to understand why the computer was overheating so much. The developer admitted that the discovery explains why his Mac was performing so poorly.

Claude Code also described how the program disguised itself in the system and set up to launch at macOS startup. However, the agent did not independently terminate processes or delete files, but first requested permission from the user. The cleanup plan included three steps: disabling the startup item through which the program launched with the system, stopping the active xmrig process, and moving the malicious files to a quarantine folder instead of permanently deleting them. In the comments, UntilHEX said he instructed the agent to perform the cleanup and the procedure went almost without problems. He had to manually delete just one file because Claude encountered an access issue, but overall the work was effective. After that, the developer additionally scanned the Mac with Malwarebytes antivirus to ensure that no traces of the program remained in the system.