CalendarFree Mac App Hides Crypto Miner
The macOS calendar app CalendarFree secretly bundles an XMR-Stak-based cryptominer that mines Monero/Graft and phones home mining stats.
Objective-See's analysis dissects CalendarFree.app, a seemingly benign macOS calendar utility that embeds a hidden 'MinerManager' class controlling a bundled XMR-Stak mining framework (identified internally as Coinstash_XMRSTAK). On launch, the app silently starts the miner process via a background dispatch block, configuring CPU core limits, throttling, and connecting to a mining pool to generate Monero (and the Graft cryptocurrency) using a hardcoded wallet/worker identifier.
Static and dynamic analysis (strings, jtool, lldb, procInfo) reveal the miner process 'xmr-stak' launched from within the app's Frameworks directory, connecting to a public mining pool endpoint over port 7777 with attacker-supplied credentials. The app also periodically reports detailed mining statistics (hashrate, battery status, location coordinates, and system telemetry) to a remote endpoint at calendar.qbix.com/api/mining, giving the operator visibility into infected hosts' mining performance and battery/power conditions to potentially throttle mining and evade detection.
This is a commodity cryptojacking case bundled inside a trojanized utility app rather than a targeted intrusion. No specific threat actor is named, and the campaign appears financially motivated, abusing victim CPU resources for cryptocurrency mining while masquerading as legitimate calendar software.
Mentioned in this report
Source reporting: https://objective-see.org/blog/blog_0x2B.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free