Claude accidentally uncovers Mac crypto-mining trojan: 12 CPU cores maxed out, temperature soars to 112 degrees Celsius

cnBeta.COM.TW_Chinese Tech News Site Home Film & TV Music Games Anime Fun Science Software Themes Hardware Apple Google iPhone Science Exploration People Mobile Games Viewpoint · Observation Alibaba Cloud Microsoft Communications Technology Android Software and Apps SONY Sony the United States USA Apple iPad Windows Phone Intel Intel Tencent HTC Security Mozilla FireFox Xiaomi Technology Baidu Telecom Operators Media Players / Video Sites BlackBerry BlackBerry Web Apps / Web Apps Google Chrome Microsoft XBOX Hardware - Netbooks / Tablets / Ultrabooks E-commerce - B2C / B2B Lenovo Lenovo LG Yahoo! Yahoo AMD SNS Social Networks Nokia Windows 7 Huawei Huawei China Mobile China Unicom China Telecom More... Rankings

A Mac user who used Anthropic's Claude to assist in software development recently unexpectedly discovered that their computer had long been infected with a cryptocurrency mining malware. Surprisingly, the problem was not first discovered through antivirus software, but was proactively identified during the process of AI-assisted development of a temperature monitoring tool.

According to the experience shared by Reddit user UntilHEX, they originally just wanted to use Claude to develop a temperature monitoring app for their Mac in order to view the device's sensor data. Because the computer had been running slowly for a long time, they hoped to use the tool to find out the cause of the performance anomaly.

While analyzing the temperature data, Claude found that the device readings were noticeably high and further checked system resource usage. The AI then alerted the user that their Mac was running an unauthorized cryptocurrency mining program.

The inspection results showed that a process named XMRig was continuously consuming about 1175% of CPU resources, equivalent to fully occupying about 12 CPU cores at the same time. Because it had been under full load for a long time, the processor temperature was pushed up to 112 degrees Celsius, close to the system's thermal limit range, which was also the main reason for the computer's sluggish operation and severe overheating.

XMRig is a legitimate open-source Monero mining software, but it is often embedded by malware authors in Trojan programs to secretly use victims' device computing power for mining profits. In this case, the program was found running in a temporary directory and connecting to a mining pool called HashVault.

More troublesome, Claude further discovered that the program was not an ordinary background process, but achieved persistent residency through a disguised LaunchAgent startup item. Even if the user manually terminated the mining process, it would automatically restart, allowing it to hide in the system for a long time.

It is worth noting that after discovering the problem, Claude did not delete files on its own, but first explained to the user the malware's operating mechanism and potential risks. The AI then requested authorization to stop the relevant startup item, terminate the mining program, and move suspicious files to a quarantine directory rather than directly deleting them permanently.

After obtaining the user's permission, Claude participated in the cleanup process. According to UntilHEX's subsequent feedback, the entire process was remarkably effective; only one file needed to be manually deleted due to permission restrictions, and most of the remaining cleanup work was completed with AI assistance. The user then also used Malwarebytes for an additional scan to confirm that the system had returned to normal.

The user later said that this discovery finally explained why their Mac had been performing abnormally for a long time. At the same time, they believed that the source of infection was likely some cracked audio plugins. The security research field has long found that a large number of pirated audio production tools and plugins bundle mining programs such as XMRig. Because music production itself is a high-CPU-load scenario, such malware is often easier to hide and less likely to be noticed by users.

This incident has also become a typical case of the expanding capabilities of AI agent tools. Claude, originally used only for writing code and analyzing temperature data, ultimately unexpectedly discovered and helped remove the mining Trojan hidden in the device by autonomously checking system operating status, helping the user restore the Mac's normal performance.

-

Rate this article

Claude unexpectedly uncovers Mac mining Trojan: 12 CPU cores fully occupied, temperature soars to 112 degrees Celsius

Four Gemini 4 Argon agents fully autonomously clear Minecraft and defeat the Ender Dragon for the first time

3 hours ago

US federal investigation documents reveal: OpenAI eavesdropping suspect was still in contact with Saudi royal family members via WhatsApp days before arrest

6 hours ago

Game decompilation community decomp.dev closes due to generative AI's impact on collaborative ecosystem

8 hours ago

Claude wants all Chinese people to be banned: the access battle of a genius AI

Developer complains about Microsoft's coding level: as amazing as it was back then, it's now just as bad Read (799) Comments (3)

2

The piracy era experienced by the post-80s and post-90s generations seems to be coming back Read (797) Comments (0)

3

Zunjie brake pedal passes inspection CarDongdi: Speechless, don't upgrade if nothing's wrong Read (794) Comments (1)

4 Father of China's etching machines: AI may be a bubble, 90% of domestic semiconductor factories will go bankrupt

5 Blogger suggests Huawei blacklist all KOLs who whitewash the Zunjie brake issue: if not for them, this wouldn't have blown up so much

6 A few dozen yuan laptop dust cleaning turns into over a thousand yuan repair: college student encounters chain scam with online "official after-sales service"

8 Sony updates high-end Walkman product line: three new flagships unveiled, top model priced as high as $5,899

9 Apple's $79 iPhone Duo case uses adhesive fixation design, drawing attention

10 Musk's public shopping screenshot leaks address and email, mocked by Gen Z

1

Windows 11 26H2 ISO images released, Microsoft simultaneously updates installation media and continues small enablement package mechanism Read (1954) Comments (1)

2

Google researcher says Windows NT kernel design still makes Linux look inferior to this day Read (1295) Comments (3)

3

Chinese female streamer sits on "paid rotating chair," viewers pay 50 yuan for one spin, bizarre livestream format sparks global discussion Read (1282) Comments (2)

4 Zhuanzhuan "mysterious glasses woman" says she was targeted by sexual rumors, has called police

5 "I definitely don't want the car anymore" Zunjie V800 brake pedal broken by stepping, owner hurriedly cancels order, experts point to serious defect

6 Wang Ziru persuades against iPhone 18 Pro: a public discussion about "upgrade value"

7 Anthropic has restricted Huawei AI chips from using Claude Opus 5.5 to develop frontier models

8 CarDongdi releases another test video: multiple models including Zhijie V9 show no brake pedal bracket fracture after six braking tests

9 "Street Fighter" movie Chun-Li actress responds to "fake" thick thighs: I don't have time to Photoshop

10 US military, due to erroneous intelligence from AI misjudgment, prepared to intercept and inspect Chinese ships, nearly creating an international conflict

created by ceallan