Claude Helps Uncover Hidden XMRig Cryptominer Pushing a Mac to 112°C
A Mac user recently discovered that their machine’s extreme overheating problem was not just a case of heavy workloads or poor cooling. The system was reportedly reaching a scorching 112°C, hitting its thermal throttling limit, and slowing down dramatically. The cause turned out to be a hidden cryptominer quietly draining CPU resources in the background.
The discovery happened after a Reddit user known as “u/UntilHEX” used Claude to build a temperature monitoring app for macOS. The goal was simple: check system temperatures and verify whether the Mac was performing normally. But during accuracy testing, Claude flagged suspicious behavior that pointed to abnormally high CPU usage. That clue eventually led to the discovery of XMRig running on the machine.
XMRig is an open-source Monero mining tool. While the software itself can be used legitimately, it is also commonly bundled with malware to hijack computers and mine cryptocurrency without the owner’s knowledge. In this case, it appears the miner had been secretly consuming the Mac’s processing power, forcing the chip to run hot and causing noticeable performance issues.
The cryptominer was reportedly running from a temporary folder and connecting to a mining pool identified as pool.hashvault.sh. Even more concerning, it was kept alive through a startup item labeled “LaunchAgent,” which used a large encoded script. That setup meant the miner could relaunch itself even after the process was manually stopped, making it harder for the user to remove.
This kind of persistence is a common tactic used by malware. On some systems, malicious miners may even try to hide when monitoring tools are opened, making them difficult to catch. In this case, the macOS temperature monitoring app created with Claude helped expose the unusual CPU behavior that finally revealed the problem.
The exact Mac model was not mentioned, but the system reportedly had 12 CPU cores, which is more than enough processing power to make it attractive for unauthorized cryptocurrency mining. Modern Apple Silicon chips are efficient and powerful, but they can still be pushed to extreme temperatures when malicious software continuously maxes out the CPU.
The incident is also a reminder that Macs, while generally secure, are not immune to malware. Users often assume macOS is safe from these types of threats, but cryptominers, launch agents, suspicious scripts, and unwanted background processes can still affect performance, battery life, and system health.
Signs of a hidden cryptominer on a Mac can include sudden overheating, loud fan noise, sluggish performance, high CPU usage when no demanding apps are open, reduced battery life, and unknown processes running in Activity Monitor. If a Mac is consistently running hot for no obvious reason, it is worth checking startup items, LaunchAgents, temporary folders, and CPU activity.
What makes this case especially interesting is the role Claude played in the troubleshooting process. The AI was not originally being used as a malware scanner. It was asked to help create a macOS temperature monitoring tool, but that tool ended up revealing the real issue. By analyzing system behavior and pointing out why the CPU was running unusually hot, Claude helped the user identify a hidden threat that had likely been active for some time.
This is not the first example of AI assisting with technical diagnostics. AI chatbots have helped users track down hardware faults, troubleshoot system crashes, write firmware, and even design complex mechanical projects. In this case, Claude acted like a coding assistant and a diagnostic helper, showing how AI tools can be useful beyond simple text generation.
For Mac users, the takeaway is clear: if your device is overheating, throttling, or suddenly performing poorly, do not ignore it. High temperatures can be caused by demanding apps, dust buildup, or software bugs, but they can also be a sign of malware. Checking CPU usage, reviewing login items, scanning for suspicious LaunchAgents, and using trusted security tools can help uncover what is really happening.
This incident shows that even a powerful Mac can be silently exploited if malicious software gets installed. It also highlights how AI-assisted tools can help users spot problems faster, especially when the symptoms are easy to dismiss as normal system strain.
