xmrig

Headlines · 2

1. 5h
   Claude Code incidentally spots an xmrig cryptominer on a Mac

   Reddit user u/UntilHEX posted in r/ClaudeAI that Claude Code, while building a Mac temperature-monitor app, dumped raw sensor readings that looked far too high, so it checked what was using the CPU and found the xmrig miner consuming about 1175% CPU, roughly 12 cores. Tom's Hardware and Wccftech, citing the post, reported CPU temperatures peaking at 112°C and said the miner persisted via a LaunchAgent startup item and an encoded script; the user said the cleanup was effective and that only one file had to be deleted manually because of an access issue, after which a Malwarebytes scan was run. According to Tom's Hardware, Claude declined to remove anything on its own and instead offered to stop the startup item and miner and move the files into a quarantine folder.

   r/ClaudeAI · 🔥 33
2. Oct 9
   PoeLLM cryptomining malware hid C2 addresses in a GitHub poem, hitting 3,400+ servers

   Lumen's Black Lotus Labs detailed a campaign it calls Canto Incognito, in which cryptomining malware named PoeLLM has infected more than 3,400 servers since at least April. Many victims appear to be internet-exposed open-source AI/LLM services such as LiteLLM and Ollama, along with the PDF-conversion API Gotenberg and self-hosted Git platform Gitea; the enterprise gateway Ivanti Sentry may also have been targeted. The malware decoded command-and-control addresses from four words in a two-stanza GitHub poem titled "On the Nature of Connection," revised 11 times so far, and dropped XMRig-based miners that turn infected hosts into scanners and exploit servers. Researchers stressed the poem is only C2 obfuscation, not prompt injection or a jailbreak style of "adversarial poetry."

   iThome 台湾 · 🔥 0

Experience and discussion from the community

Share my xmrig experienceAsk about xmrig