Abstract:
A Mac user who uses Anthropic's Claude auxiliary development software recently accidentally discovered that his computer had been infected by a cryptocurrency mining malicious program for a long time. Surprisingly, the problem was not first discovered through anti-virus software, but was proactively identified during the development of temperature monitoring tools assisted by AI.
According to the experience shared by Reddit user UntilHEX, he originally wanted to use Claude to develop a temperature monitoring application for his Mac to view the device's sensor data. Since his computer has been running slowly for a long time, he hopes to use this tool to find out the cause of abnormal performance.
While analyzing the temperature data, Claude found that the device readings were significantly high and further checked the system resource usage. The AI then prompted the user that their Mac was running an unauthorized cryptocurrency mining program.
The inspection results show that a process named XMRig is continuously occupying about 1175% of CPU resources, which is equivalent to occupying about 12 CPU cores at the same time. Due to being under full load for a long time, the processor temperature is pushed up to 112 degrees Celsius, which is close to the system thermal limit area. This is also the main reason why the computer runs slowly and heats up seriously.
XMRig is a legal open-source Monero mining software, but it is often embedded into Trojan programs by malware authors to secretly use the computing power of the victim's device for mining profits. In this case, the program was found running in a temporary directory and connected to a mining pool called HashVault.
What's even more troublesome is that Claude further discovered that the program was not an ordinary background process, but used a disguised LaunchAgent startup item to achieve persistence. Even if the user manually ends the mining process, it will automatically restart, so it can remain hidden in the system for a long time.
It is worth noting that Claude did not delete the files without authorization after discovering the problem. Instead, he first explained the operating mechanism and potential risks of the malicious program to the user. AI then requested authorization, hoping to stop related startup items, terminate the mining program, and move suspicious files to the quarantine directory instead of directly deleting them permanently.
With the user's permission, Claude participated in the cleanup process. According to UntilHEX's follow-up feedback, the entire processing process was very effective. Only one file needed to be deleted manually due to permission restrictions, and most of the remaining cleanup work was completed with AI assistance. The user then performed additional scans using Malwarebytes to confirm that the system had returned to normal.
The user later said that this discovery finally explained why his Mac had been acting abnormally for a long time. At the same time, he believes that the source of the infection is likely to come from some cracked audio plug-ins. The security research field has long discovered that a large number of pirated audio production tools and plug-ins are bundled with mining programs such as XMRig. Since music production itself is a high CPU load scenario, such malicious programs are often easier to hide and difficult to detect by users.
This incident has also become a typical case of expanding the capabilities of AI agent tools. Claude, who was originally only used to write code and analyze temperature data, finally accidentally discovered and assisted in removing the mining Trojan hidden in the device by independently checking the operating status of the system, helping users restore the normal performance of the Mac.
Comments