Claude Code just exposed a hidden $XMR miner draining a Mac for months.
User asked Claude to check temps. Claude dug deeper and found:
→ xmrig process eating 1175% CPU (12 cores)
→ CPU spiking to 112°C
→ Miner running from /tmp, sending hashes to a pool
→ Startup script with random name auto-restarting the miner on kill
→ Been active since August, way before the app install
Claude didn't touch anything. Just flagged it, showed the GitHub login tied to the Mac, and asked permission before cleanup.
Wanna scan your own Mac? Drop this into Claude Code:
"Check this Mac for anything suspicious. Read only: don't kill, delete or change anything.
1. List top 15 processes by CPU/memory with paths. Flag anything in /tmp or with random names.
2. List every item in ~/Library/LaunchAgents, /Library/LaunchAgents, /Library/LaunchDaemons: what it runs, creation date, signature status. Flag encoded scripts and unmatched installs.
3. List open network connections and their processes. Flag mining pools and unknown hosts.
4. Tell me what you found, confidence level, and next steps. Wait for my approval before changing anything."
Your rig might be mining for someone else right now.
User asked Claude to check temps. Claude dug deeper and found:
→ xmrig process eating 1175% CPU (12 cores)
→ CPU spiking to 112°C
→ Miner running from /tmp, sending hashes to a pool
→ Startup script with random name auto-restarting the miner on kill
→ Been active since August, way before the app install
Claude didn't touch anything. Just flagged it, showed the GitHub login tied to the Mac, and asked permission before cleanup.
Wanna scan your own Mac? Drop this into Claude Code:
"Check this Mac for anything suspicious. Read only: don't kill, delete or change anything.
1. List top 15 processes by CPU/memory with paths. Flag anything in /tmp or with random names.
2. List every item in ~/Library/LaunchAgents, /Library/LaunchAgents, /Library/LaunchDaemons: what it runs, creation date, signature status. Flag encoded scripts and unmatched installs.
3. List open network connections and their processes. Flag mining pools and unknown hosts.
4. Tell me what you found, confidence level, and next steps. Wait for my approval before changing anything."
Your rig might be mining for someone else right now.