Claude Code reportedly finds XMRig using 1175% CPU on a Mac
A Reddit user says a LaunchAgent and pool.hashvault.sh kept the miner alive; the report is unverified.
Stories per day · 30 days
1 RSS
9 stories, newest first · one card per story
Stories tagged #cryptojacking
AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
Ahsay re-patched exploited AhsayCBS flaws after incomplete fixes still allowed web shells and XMRig miners.
Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge
Attackers are exploiting two AhsayCBS flaws to deploy web shells and XMRig miners disguised as Microsoft Edge.
Poetry is the new AI security threat as PoeLLM malware infects 3K+ servers
PoeLLM malware has infected over 3,000 servers since April, hiding command-and-control in a GitHub poem while mining cryptocurrency.
3
Hackers Turn More Than 3,500 Redis Servers Into Cryptocurrency Miners
Hunters.io researchers report 3,562 exposed Redis servers hijacked via replication abuse into Monero cryptomining, causing performance loss and data-integrity risk.
3
Massive Redis Cryptojacking Campaign Hijacks Thousands of Linux Servers
RedisRaider cryptojacking campaign compromises thousands of exposed, unauthenticated Linux Redis servers using cron persistence to deploy XMRig Monero miners.
6
Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner
CISA added actively exploited Gitea RCE CVE-2026-60004 (CVSS 9.8) to the KEV catalog as attackers deploy a cryptojacking dropper.
3
Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004)
Attackers are actively exploiting critical Gitea RCE CVE-2026-60004 via the diffpatch endpoint, prompting CISA KEV addition and at least one cryptomining compromise.
4
Apple macOS Screen Sharing Flaw Exploited on Internet
Actively exploited CVE-2026-65400 in macOS Screen Sharing grants pre-auth root access; attackers deploy Monero miners on exposed systems.
2