Hidden Cryptominer Mac Overheating: Signs and Checks

What happened

A Mac owner who was building a temperature monitoring app with help from Claude Code, an AI coding assistant, found out why the machine had been running hot and slow. According to the owner's Reddit post, shared by 9to5Mac on October 26, 2026 and first covered by Tom's Hardware and WCCFTech on October 19, the assistant reported a hidden cryptominer on the machine in plain terms:

Most important: your Mac is running a cryptominer that I didn't put there. While checking sensor accuracy I saw xmrig using about 1175% CPU, roughly 12 cores. That is why your temperatures are so high, with the CPU peaking at 112C.

Claude Code, quoted in the owner's Reddit post

The process was xmrig, also written XMRig. It is a legitimate open-source program for mining the Monero cryptocurrency, and it is also commonly bundled with malware that installs it secretly on other people's computers, a practice often called cryptojacking. WCCFTech, summarizing the same post, reported that the miner ran from a temporary folder, mined to a pool called pool.hashvault.sh, and was kept alive by a startup item described as a LaunchAgent running a large encoded script, so it would restart if the process was killed.

Read the numbers carefully. macOS reports CPU use per core, so 100% is one full core. A process at about 1175% is using roughly 12 cores at once, not 1175% of the whole machine in some impossible sense. The 112C peak and the exact Mac model come from the owner's account as reported by these outlets. No outlet published a forensic report, the specific model was not named in the coverage, and how the miner got onto the Mac has not been established. Treat this as one well documented case, not proof that every hot Mac has malware on it.

What it means for your Mac's thermals

A cryptominer is close to a worst case workload for cooling, because it is built to use every spare cycle, all the time. A video export or a game eventually ends. A miner does not. It holds the CPU near full load at idle, overnight, and while you work, so the fans run far more than your actual work explains and the chip sits near its thermal limit for hours instead of minutes.

Your Mac protects itself in that situation, and the protection is the symptom many people notice first. When temperatures keep climbing, macOS slows the chip down, which is thermal throttling. The machine gets sluggish not because it is old, but because it is deliberately holding performance back to stay safe. Our guide to Mac thermal throttling explains how that trade works.

Fan control cannot fix this, and this is the most important lesson in the story. Fans move heat away from the chip. They do not remove the workload creating the heat. Setting a louder or earlier fan curve on a Mac with a hidden miner buys a few degrees while the miner keeps running, drains the battery faster on a laptop, and delays finding the real cause. If your Mac is hot while it should be idle, check the workload before you touch any fan setting. That order of operations is the whole point of our guide to what to check when a Mac is overheating.

How to check your Mac

Check Activity Monitor first. Open Activity Monitor, click the CPU tab, and sort by % CPU while your Mac is idle. A process you do not recognize holding several hundred percent or more, for minutes at a time, is a suspect. Search the exact process name before you quit anything you are unsure about, because some high readings are normal system work.
Treat a process that comes back as the real red flag. If an unknown process returns after you quit it, or returns after a restart, something is relaunching it. That persistence is what separated this miner from a normal runaway app.
Review what starts on its own. In System Settings, open General, then Login Items, and review both the apps that open at login and the background items allowed to run. Remove anything you do not recognize and did not install on purpose.
Run a scan and stay current. Run a scan with a trusted security tool, and keep macOS and your apps updated. Apple builds malware detection and removal into macOS, and those protections depend on staying current. If a scan finds a miner, follow the tool's removal steps, then recheck Activity Monitor and Login Items after a restart to confirm it stays gone.
Install software only from reliable sources. Apple makes the same point in its malware guidance: a common way malware arrives is bundled inside a harmless looking app. Free downloads of paid software and plugins from unofficial sites are a classic delivery route for exactly this kind of bundled miner.
Do not mask the heat. Do not respond by maxing out your fans and moving on. If temperatures stay high after you remove the suspect process, or the Mac shuts down, glitches, or shows a diagnostics warning, stop and get service help instead of masking the heat.

What Smart Breeze shows you

Heat is your best early warning. Most malware tries to stay quiet, but a miner cannot hide its physics. Sustained high temperature, fans at full speed during light work, fast battery drain, and a machine that never cools down at idle are all measurable signals. Watching your temperatures over time, as covered in how to check your Mac temperature, turns a vague feeling that the Mac runs hot into a number you can act on. Smart Breeze records those trends locally on your Mac, so a baseline that suddenly stops settling at idle stands out fast.

Sources

View CPU activity in Activity Monitor on Mac (Apple Support)
Keep your Mac laptop within acceptable operating temperatures (Apple Support)
Use Apple Diagnostics to test your Mac (Apple Support)

A Hidden Cryptominer Pushed This Mac to 112C: How to Check Yours