Why does my antivirus say XMRig is a threat?

Your antivirus may flag XMRig because it is mining software, and attackers often install miners without the device owner’s permission. XMRig is a legitimate, publicly available tool, but the warning alone cannot tell you whether your copy is safe or whether someone put it there without your knowledge.

Why a legitimate miner gets flagged

XMRig uses your processor, or CPU, to do the calculations involved in mining Monero. That work can keep your computer busy for long periods, drawing electricity and producing heat.

Attackers abuse the same tool for cryptojacking: secretly using someone else’s computing power to mine coins. Because this happens often, antivirus products may flag XMRig even when you installed it yourself.

Your antivirus might describe it as:

• CoinMiner or cryptominer: software that mines cryptocurrency.
• Riskware: software with legitimate uses that can also be abused.
• Potentially unwanted application: software you might not have knowingly agreed to install.
• Trojan: a stronger warning that the file may be malicious or part of a malicious package.

These names vary between antivirus companies. A mining-related label does not automatically prove an infection, but you should not dismiss it as a mistake.

The key question: did you choose to install it?

If you deliberately installed XMRig, the alert may be identifying its mining function rather than a separate harmful feature. You still need to check where the file came from and whether it is the copy you expected.

If you never installed a miner, treat the warning as a possible security incident. An attacker may have bundled XMRig with another program or installed it after gaining access to your computer.

Clues worth checking include:

• Your fans run loudly while you are doing little.
• CPU use stays unusually high.
• A mining process returns after you stop it.
• The file appeared after installing unofficial software or opening a suspicious attachment.

These signs are not proof by themselves. Other programs can cause high CPU use, and an unwanted miner may hide its activity.

What to do before allowing it

Do not disable your antivirus or add an exception just because a mining guide tells you to.

If the installation was unexpected, let your antivirus block or quarantine it. Quarantine isolates a file so it cannot normally run. Update your security software and run a full scan; removing the miner alone may not remove whatever installed it. On a work or school device, contact your IT team.

If you installed XMRig intentionally:

• Confirm that you obtained it from the official XMRig project’s release source, not an advertisement or random download.
• Compare its published checksum, a file fingerprint, if one is available from a trusted source.
• Review the mining settings, including the wallet address that receives credit.
• Check your antivirus vendor’s explanation of the detection.

A matching checksum helps confirm the download matches the published file. It is not a guarantee that software is harmless.

The bottom line

An XMRig alert often means “this program can mine,” not necessarily “this program steals your data.” But an unexpected copy is a serious warning. Only consider a narrowly scoped antivirus exception after verifying an intentional installation—and only mine on devices you own or have explicit permission to use.