โก๏ธ๐ค NEW - A Mac user says Claude Code was building them a temperature monitor app when it found a cryptominer using 12 cores.
The readings looked too high, so it checked the CPU and found XMRig at ~1175%, with the chip at 112ยฐC.
Nice find by the AI, but the takeaway is the monitoring gap, not the luck. A miner pins cores, so the signal is boring and reliable: sustained CPU above ~90% for 5 minutes is an alert, not a curiosity. The second check is egress. XMRig phones home to a pool, so an alert on outbound to anything outside an allowlist catches it even on a quiet core. Either one turns this from a lucky find into a permanent tripwire, and both run on a Mac with nothing but a log file and a notification.
For those who think this is "just" a miner - nope, this a complete system compromise. Da end. Make a forensic snapshot for data leak an lateral movement assessment and wipe everything