CoinMiner covers macOS malware that secretly uses your Mac's processor to mine cryptocurrency, usually bundled with pirated software; one well-documented family, LoudMiner, came with cracked audio plug-ins and mined Monero inside a hidden Linux virtual machine. If your fans run hard while the Mac is idle, open Activity Monitor, sort by CPU and look for processes you don't recognize, such as qemu-system-x86_64.
Last reviewed · 2 sources
Also known as: OSX.CoinMiner, Bird Miner, LoudMiner, CreativeUpdate
CoinMiner is a label for macOS malware that mines cryptocurrency on the victim's Mac for the attacker. ESET documented LoudMiner in June 2019: distributed with pirated VST audio software since August 2018, it used QEMU on macOS to run a Tiny Core Linux virtual machine with the XMRig miner for Monero, and users reported a qemu-system-x86_64 process taking 100% of their CPU. Mining keeps the processor busy, so the signs are heat, loud fans, a slow Mac and shorter battery life.
Pirated VST plug-ins and audio apps (ESET's LoudMiner)
Other cracked professional apps from torrent sites
Installers that add a launch item so the miner restarts
Fans running hard and the Mac hot even when idle
A process you don't recognize near the top of Activity Monitor's CPU list
A qemu-system-x86_64 process you didn't start
Battery draining faster than usual
Open Activity Monitor and sort by % CPU. Look for unfamiliar processes that stay near the top, names like xmrig, or qemu-system-x86_64 running a virtual machine you didn't create.
Select the process and click Force Quit, then find and delete the files behind it. Activity Monitor's Open Files and Ports tab shows where a process lives.
Check ~/Library/LaunchAgents, /Library/LaunchAgents and /Library/LaunchDaemons for plists you didn't create, and run crontab -l in Terminal to check for scheduled jobs.
Delete the pirated or cracked app the miner came with from /Applications and ~/Downloads.
If QEMU was installed without you, remove it and the virtual machine files that came with it.
Running apps and startup items are two of the six checks in CoreLock's free scan. Review what it lists; it can't promise to find every miner.
Don't download pirated or cracked software; miners are a common payload
Glance at Activity Monitor when your Mac runs hot for no reason
Be suspicious of free versions of expensive professional software
Get plug-ins from the developer or an established store
What it can and can't do
A miner shows up as a busy process, and running apps are one of the six checks in CoreLock's free scan, alongside startup items for the launch items a miner adds to restart itself. CoreLock can't promise to catch every variant, and its Security Score isn't an infection probability.
System Settings › Privacy & Security › Accessibility (on macOS 27, some developers' guides call this pane Device Control and Data Access)
System Settings › Privacy & Security › Input Monitoring
System Settings › Privacy & Security › Location Services
Signs include fans at full speed while the Mac is idle, a lot of heat, faster battery drain and a slow Mac. Open Activity Monitor and sort by CPU; a process you don't recognize that stays near the top is worth a closer look.
It keeps the processor under heavy load for hours, so the Mac runs hot and loud and the battery drains faster. The attacker gets the cryptocurrency; you pay for the electricity and the wear.
ESET suspected LoudMiner's operators chose VST plug-ins because music production needs powerful machines that are often left running, which suits mining.
LoudMiner ran inside a QEMU Linux virtual machine. In Activity Monitor, look for qemu-system-x86_64, quit it, then delete the virtual machine files, the QEMU install you didn't add, the launch items that start it, and the pirated app that brought it.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser