XMRig

Headlines · 2

1. 4h
   Claude Code incidentally spots an xmrig cryptominer on a user's Mac

   A Reddit user, UntilHEX, had Claude Code build a Mac temperature monitor app; when the agent dumped raw sensor readings to check accuracy, the numbers looked far too high, so it checked CPU usage and found the xmrig cryptominer consuming about 1175% CPU, roughly 12 cores. Tom's Hardware, citing the post and a screenshot of the Claude Code window, reported the CPU peaked at 112 degrees Celsius and that the agent declined to remove anything on its own, instead offering to stop the startup item and miner and quarantine the files. The user later said Claude was tasked with the cleanup, that only one file had to be deleted manually because of an access issue, and that a Malwarebytes scan was run to check the result.

   r/ClaudeAI · 🔥 14
2. Oct 9
   PoeLLM cryptomining malware hid C2 addresses in a GitHub poem, hitting 3,400+ servers

   Lumen's Black Lotus Labs detailed a campaign it calls Canto Incognito, in which cryptomining malware named PoeLLM has infected more than 3,400 servers since at least April. Many victims appear to be internet-exposed open-source AI/LLM services such as LiteLLM and Ollama, along with the PDF-conversion API Gotenberg and self-hosted Git platform Gitea; the enterprise gateway Ivanti Sentry may also have been targeted. The malware decoded command-and-control addresses from four words in a two-stanza GitHub poem titled "On the Nature of Connection," revised 11 times so far, and dropped XMRig-based miners that turn infected hosts into scanners and exploit servers. Researchers stressed the poem is only C2 obfuscation, not prompt injection or a jailbreak style of "adversarial poetry."

   iThome 台湾 · 🔥 0

Experience and discussion from the community

Share my XMRig experienceAsk about XMRig