A developer’s Mac was reportedly running an unauthorized XMRig cryptocurrency miner that consumed roughly 12 CPU cores and pushed the processor to 112°C, or 233.6°F. The discovery emerged while the owner, Reddit user UntilHEX, was using Anthropic’s Claude Code to build a macOS temperature-monitoring application.
The case highlights how cryptojacking can remain active on a modern laptop while producing few obvious signs beyond heat, fan noise, and reduced performance. It also shows how a routine development task can surface suspicious system activity that the user had not noticed.
What was found
According to the developer’s account, Claude Code was checking the accuracy of the Mac’s temperature sensors when it identified a process named xmrig. The reported CPU usage was about 1,175%, which on macOS can correspond to roughly 12 fully occupied logical cores.
The agent reported that the processor peaked at 112°C and linked the heat to the sustained mining workload. The user said the Mac had been running unusually slowly and hot before the discovery.
“Most important: your Mac is running a cryptominer that I didn’t put there. While checking sensor accuracy I saw xmrig using about 1175% CPU, roughly 12 cores. That is why your temperatures are so high, with the CPU peaking at 112°C.”
The quote was shared in the developer’s public report and subsequently cited by technology outlets including 9to5Mac, Macworld, and Tom’s Hardware. The incident has not been published as an independent forensic investigation, so the installation route and full scope of the compromise remain unconfirmed.
How XMRig works
XMRig is a legitimate, open-source, cross-platform mining program that supports CPU and GPU mining algorithms including RandomX, KawPow, CryptoNight, and GhostRider. It is commonly associated with Monero (XMR), a cryptocurrency designed to be mineable with ordinary processors.
That compatibility is also why XMRig appears frequently in cryptojacking campaigns. Attackers can install or configure it on machines they do not own, then direct its computing output to a mining pool while the device owner bears the electricity cost, heat, wear, and performance loss.
XMRig provides official macOS builds, including support for Apple Silicon since version 6.7.0. Its presence alone does not prove malware: the security issue in this case is the alleged unauthorized installation, persistence, and use of the owner’s hardware.
Persistence and cleanup
The developer’s account said the miner was configured to launch automatically when the Mac started. Reports of the incident identified a startup mechanism in the macOS LaunchAgents folder and a running location associated with /tmp/rigupdater.
Claude Code reportedly proposed stopping the process, disabling its startup entry, and moving related files into quarantine. The owner then manually removed at least one component that the agent could not access and ran a third-party security scan to verify removal.
After cleanup, the user reported that the Mac returned to normal temperatures and performance. Secondary coverage also reported that the miner may have been connecting to pool.hashvault.sh, though that detail has not been independently verified.
Real-world impact
The reported figures illustrate the resource cost of unauthorized mining on a consumer laptop:
- About 1,175% CPU utilization, equivalent to approximately 12 logical cores.
- A reported processor temperature peak of 112°C, or 233.6°F.
- Automatic startup behavior that allowed the miner to persist across reboots.
- Noticeable system slowdown and sustained heat reported by the device owner.
High CPU temperatures can trigger thermal throttling, reducing performance to protect hardware. A single reported incident does not establish permanent damage, but prolonged operation at extreme temperatures can increase fan wear, reduce battery life, and degrade the user experience.
What remains unclear
The report does not establish how XMRig entered the Mac, when the infection began, whether additional malware was present, or whether the cleanup removed every related artifact. Because the evidence consists primarily of a user report and screenshots, security professionals would normally seek disk, network, and persistence-layer forensic evidence before drawing broader conclusions.
Over the next 12 to 24 months, the practical challenge for Mac users and IT teams will remain detection of low-profile cryptojacking: monitoring unexpected background CPU load, reviewing login items and LaunchAgents, keeping macOS and security tools updated, and investigating machines that run hot or slow without an apparent workload.
