How can I tell if XMRig on my computer is malware?

XMRig is a real mining program, not automatically malware. But if someone installed it without your permission, or another program secretly runs it, treat that as a security problem. The best clues are how it got there, what starts it, and whether its settings match what you agreed to.

Start with permission and where it came from

Ask yourself: Did you knowingly install XMRig or agree to software that uses it? If you did not, investigate—even if your antivirus says nothing.

XMRig normally runs as a separate program on your computer. Simply opening a mining website should not silently install it as a background service.

If you installed it yourself, check:

• Did you get it from the official XMRig project rather than an ad, message attachment, or software bundle?
• Is it in the folder where you put it?
• Does it run only when you expect it to?
• Did you knowingly set it to start when your computer starts?

A file named xmrig is not proof of either safety or danger. Attackers can rename mining software, and malicious files can copy legitimate names.

Look at what is actually running

On Windows, open Task Manager. On macOS, use Activity Monitor. On Linux, use your system monitor. Look for sustained high CPU use, meaning heavy use of your computer’s main processor.

High CPU use, fan noise, and extra heat can point to mining, but they can also come from games, updates, or video work.

For a suspicious process, check its file location and, where available, its command line—the instructions used to launch it. You may need administrator tools or technical help to see these details.

Warning signs include:

• Running from an unexpected temporary or hidden folder.
• Starting through an unfamiliar scheduled task or background service.
• Reappearing after you stop it.
• Launching from a program you do not recognize.

None of these alone proves malware. Together, especially without your consent, they are strong reasons for concern.

Check its settings and antivirus alerts

XMRig often uses a file called config.json. Its settings may show a mining pool, a service that combines miners’ work, and a wallet address or account identifier that determines who gets paid. Settings can also come from launch instructions rather than a file.

If you set up mining for yourself, compare these details with your intended setup. An unfamiliar destination deserves investigation, though some services use their own accounts and payout systems.

Antivirus tools may label legitimate XMRig as a “coin miner” or “potentially unwanted application” because attackers frequently abuse it. That warning does not settle the question—but do not dismiss it or add an antivirus exception before checking the installation.

A digital fingerprint, called a file hash, can help you compare a download against a trusted release. Even an authentic XMRig copy can be used without your permission.

If you did not authorize it

Disconnect from the internet if you suspect an active compromise. Stop the miner, then run an updated security scan; use an offline scan if your security software offers one.

Do not just delete the executable. Another program or startup task may reinstall it. If it returns, seek trusted technical help. If broader compromise is suspected, change important passwords from a clean device.

The bottom line

The key question is not “Is this really XMRig?” It is “Did you authorize this installation and what it is doing?” A genuine miner running secretly is still unauthorized software and should be treated seriously.