For weeks the machine ran hot and nobody noticed. The fan never got loud enough to alarm anyone, headphones were on, and Blender sat in the background anyway. What exposed the intruder was a tool built to measure exactly that heat.
A Mac owner known on Reddit as UntilHEX pointed Anthropic’s Claude Code at a small project: an app reporting how warm the hardware runs. Dumping raw sensor figures to verify them, the agent hit numbers that could not be real and went hunting. A binary named xmrig was sitting on roughly 1,175% processor load, about twelve cores, with the chip near 112C.
How it stayed hidden for two months
The agent informed its human that a miner was running without its knowledge. A startup item planted on August 29 relaunched the process whenever it exited, via a KeepAlive flag. Execution happened out of a temp directory, with results shipped to a Monero pool at pool.hashvault.sh. XMRig is genuine open-source mining software, which is why criminals recycle it.
The assistant took no unsupervised action. It offered to terminate the process and quarantine its files, then paused for approval. UntilHEX agreed, later clearing one stubborn file by hand after a permissions problem, and finished with a Malwarebytes sweep.
The protections that should have caught it
Two Apple defenses ought to have intervened. XProtect already carries signatures naming this miner, and Gatekeeper refuses binaries lacking a developer signature. Both were evidently bypassed, so the planted copy had almost certainly been altered. How it arrived remains unanswered, though the owner blamed bootleg audio plugins.
Creative software has long been the delivery route. Jamf analysts described miners bundled into pirated Final Cut Pro and Logic Pro downloads in 2023.
A fan that never settles or steady warmth with nothing demanding running is worth investigating.
