Is XMRig itself malware or just a legitimate miner?

XMRig itself is legitimate mining software, not inherently malware. But someone can use it as part of malware to mine on your device without your permission, so the important question is who installed it, where it came from, and whether you agreed to run it.

What XMRig normally does

XMRig is an open-source miner. That means its source code—the instructions that make the program work—is available for people to inspect. You can use it to put your computer’s processor, or CPU, to work mining Monero.

Monero uses RandomX, a mining algorithm designed to favor CPUs. An algorithm is simply a set of rules for doing a task. XMRig performs the calculations needed to participate in mining and can send that work to a mining pool, a service where miners combine their efforts and share rewards.

When you knowingly install it on your own computer, choose its settings, and understand the electricity and hardware costs, that is ordinary, legitimate use. XMRig is normally a standalone program, not something you need just to browse a website.

Open-source status does not guarantee that every download labeled “XMRig” is safe. Someone can change the code or bundle the real miner with harmful software.

Why antivirus software may flag it

Security tools often flag mining software because attackers commonly install it without permission. This abuse is called cryptojacking: someone uses your computing power and electricity to earn coins for themselves.

A warning might identify XMRig as a “coin miner,” “riskware,” or a “potentially unwanted application.” Those labels do not all mean the same thing:

• Coin miner: The tool recognizes mining software or mining behavior.
• Riskware: The program has legitimate uses but could be abused.
• Potentially unwanted application: You may not have clearly agreed to install or run it.

A miner warning on a copy you deliberately installed may reflect its function rather than a hidden attack. But you should not dismiss the warning automatically. The surrounding files, installation method, and behavior matter.

How to judge the copy on your device

Start with a simple question: Did you intentionally install and start it?

If you did, check that you obtained it from the official XMRig project rather than an advertisement, unsolicited message, or repackaged download. Where available, compare its file checksum—a digital fingerprint of the file—with the value published by the project.

Also check its settings. Do you recognize the mining pool and payout destination? Some services use an account identifier rather than your wallet address. XMRig also has a documented developer-donation feature; expected donation activity is not, by itself, evidence of theft.

Warning signs include:

• You never installed a miner.
• It runs from an unexpected folder or keeps returning after removal.
• Its settings point to an account you do not recognize.
• It arrived with cracked software or a suspicious installer.

High CPU use, fan noise, and heat are normal during mining. They show that your computer is working hard, but do not alone prove malware.

The bottom line

XMRig is a legitimate tool that can be misused. If you find an unexpected copy, stop it, run a trusted security scan, and investigate how it arrived. Do not disable antivirus protection just because someone claims that every mining warning is harmless.