Claude Code Spots XMRig Mining Trojan on Mac: A Self-Check Guide

Incident Recap: An Accidental Security Scan

According to a Reddit user's post, while using Claude Code to develop a weather app, they accidentally discovered that an XMRig mining program was running on their Mac, consuming about 12 CPU cores. Claude Code is an AI coding assistant launched by Anthropic that can analyze code and system status. The user stated that Claude Code detected an abnormal process during the build process and flagged the presence of XMRig.

This incident quickly sparked discussion in the tech community, but it's important to be clear: currently there is only this single Reddit user as a source, and no official or independent security organization has confirmed it. Claude Code itself is not a dedicated antivirus tool; its detection capability may stem from monitoring system resources or discovering anomalies during code analysis.

What Is XMRig? Why Does It Appear on Macs?

XMRig is an open-source Monero mining software that is often exploited by malicious attackers, implanted into user devices through bundled downloads, vulnerability exploits, or malicious scripts. XMRig on the Mac platform typically exists in the form of disguised processes, startup items, or browser extensions. Once running, it consumes a large amount of CPU resources, causing the device to heat up, battery life to drop, and performance to plummet.

In this case, the mining program occupied 12 cores, which is a significant anomaly for multi-core Macs. If ordinary users notice fans running wildly or unfamiliar high-CPU processes in Activity Monitor, they should be on alert.

Monero (XMR) and the Economic Logic of Mining Trojans

Monero (XMR) is a privacy-focused cryptocurrency whose mining algorithms CryptoNight/RandomX are designed to be relatively CPU-friendly, and transactions are difficult to trace. These two points make it a top choice for malicious mining: attackers can profit from the idle CPU power of a large number of ordinary user devices without needing dedicated mining rigs, and anonymity reduces the risk of tracing fund flows. XMRig itself is legitimate open-source mining software, but precisely because it is open-source, easy to compile, and can run silently, it is often repackaged by attackers and implanted as a trojan. So-called "mining trojans" usually do not encrypt user files or pop up ransom demands; instead, they lurk long-term and quietly consume computing power, making them far more stealthy than traditional ransomware. Users often only notice when the device overheats or electricity bills are abnormal.

How to Self-Check: Read-Only Inspection Steps

The following operations are all read-only, will not modify system files, and can be safely executed:

1. Use Activity Monitor to Check CPU Usage

Open "Activity Monitor," sort by CPU in descending order, and observe whether there are processes named xmrig, miner, or random strings continuously consuming high CPU. Note: malicious processes may disguise themselves as system process names, so judgment should be combined with the path.

2. Terminal Command Inspection

Run the following commands in Terminal (view only, do not terminate processes):

ps aux | grep -i xmrig
ps aux | grep -i miner

If suspicious processes are found, record their PID and path, and do not delete them immediately so that further analysis can be performed.

Notes on the ps aux and launchctl Commands

ps aux is used to list all running processes and their detailed information on the system, where a means show processes of all users, u means output in a user-friendly format (including CPU and memory usage), and x means include background processes without a controlling terminal. Combined with grep -i, it can filter by process name case-insensitively. launchctl list lists tasks currently managed by launchd, which is macOS's initialization and process management daemon; malicious programs that start automatically at boot often register here. ~/Library/LaunchAgents stores the current user-level startup configuration (plist files), while /Library/LaunchDaemons contains system-level tasks that run without user login—the latter has higher privileges and deserves more focused scrutiny.

3. Check Startup Items and Login Items

• System Settings > General > Login Items, check for unfamiliar apps.
• Run launchctl list | grep -i miner in Terminal to check launchd tasks.
• Check plist files in the ~/Library/LaunchAgents and /Library/LaunchDaemons directories.

4. Browser Extension Review

Malicious mining scripts are often injected through browser extensions. Check the extension lists of Safari, Chrome, and other browsers, and remove unknown or suspicious extensions.

5. Use Security Tools to Scan

You can run free tools such as Malwarebytes or KnockKnock for read-only scanning, but be sure to download them from official channels.

Gatekeeper and macOS's Malware Protection Mechanisms

macOS has multiple built-in layers of protection: Gatekeeper verifies whether an app comes from an identified developer and has been notarized by Apple, blocking unsigned or unknown-origin programs from running directly; XProtect is a signature-based malware signature database that matches when apps launch. However, these mechanisms mainly target known signatures and conventional distribution channels, and are not fully effective against mining trojans implanted through scripts, cracked software, or social engineering. Attackers often bypass checks by tricking users into manually allowing apps in "Privacy & Security" or by using signed but tampered installation packages. Therefore, Gatekeeper and XProtect should be regarded as a baseline defense, not a sufficient guarantee, and combining them with third-party read-only scanning tools and manual inspection is still necessary.

Claude Code's Detection Capabilities and Limitations

As an AI coding assistant, Claude Code's main function is to assist with code generation and debugging. Its ability to discover XMRig may stem from sensitivity to abnormal system resources, or from the user outputting relevant system information while building the app. But this is not Claude Code's design goal, nor should it be regarded as a security product. Anthropic has not claimed that Claude Code has anti-malware capabilities.

The value of this incident lies in reminding developers: while AI tools assist development, they can also become "observers" of system anomalies. However, relying on AI for security detection is not reliable, and professional security software remains a necessary supplement.

Incident Authenticity and Community Reaction

Currently, this incident has only one Reddit post as its source and lacks independent verification. Some community members questioned how Claude Code "discovered" XMRig—was it actively scanning, or did the user happen to see it? The post did not provide detailed logs. Therefore, we should treat it as a cautionary case rather than a confirmed security incident.

Nevertheless, it is reasonable for Mac users to remain vigilant about mining trojans. In recent years, the number of malware targeting macOS has been on the rise, and XMRig is one of the common payloads.

Prevention Recommendations

• Download software only from official channels and avoid cracked versions.
• Regularly check Activity Monitor and startup items.
• Keep macOS updated and enable Gatekeeper.
• Stay alert to unknown links and attachments.

Security is no small matter; an accidental discovery may help avoid greater losses.