VORANT. Threat Intelligence Sign in Get the full feed

CalendarFree Mac App Hides Crypto Miner

routine threat

The macOS calendar app CalendarFree secretly bundles an XMR-Stak-based cryptominer that mines Monero/Graft and phones home mining stats.

Objective-See's analysis dissects CalendarFree.app, a seemingly benign macOS calendar utility that embeds a hidden 'MinerManager' class controlling a bundled XMR-Stak mining framework (identified internally as Coinstash_XMRSTAK). On launch, the app silently starts the miner process via a background dispatch block, configuring CPU core limits, throttling, and connecting to a mining pool to generate Monero (and the Graft cryptocurrency) using a hardcoded wallet/worker identifier.

Static and dynamic analysis (strings, jtool, lldb, procInfo) reveal the miner process 'xmr-stak' launched from within the app's Frameworks directory, connecting to a public mining pool endpoint over port 7777 with attacker-supplied credentials. The app also periodically reports detailed mining statistics (hashrate, battery status, location coordinates, and system telemetry) to a remote endpoint at calendar.qbix.com/api/mining, giving the operator visibility into infected hosts' mining performance and battery/power conditions to potentially throttle mining and evade detection.

This is a commodity cryptojacking case bundled inside a trojanized utility app rather than a targeted intrusion. No specific threat actor is named, and the campaign appears financially motivated, abusing victim CPU resources for cryptocurrency mining while masquerading as legitimate calendar software.

Mentioned in this report

Malware CalendarFreexmr-stak (Coinstash)

Detection guidance

macOS Application Spawning Cryptocurrency Miner Process

ATT&CK T1496

Detects a non-standard application (e.g., calendar/utility app) launching xmr-stak or similar miner binary from its Frameworks directory - indicative of bundled cryptojacking payload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: macOS Application Spawning Cryptocurrency Miner Process
description: Detects applications spawning xmr-stak or other known XMR/cryptocurrency
  miner processes from internal app Frameworks. Targets the pattern where trojanized
  utility apps silently launch miners to hijack CPU resources.
tags:
- attack.t1496
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith:
    - /xmr-stak
    - /xmrig
    - /cpuminer
    ParentImage|contains: .app/Contents/Frameworks
  filter_legitimate_mining:
    ParentImage|contains:
    - /Monero
    - /mining-pool
  condition: selection and not filter_legitimate_mining
falsepositives:
- Legitimate Monero wallet or mining pool software launching its own miner subprocess
- Cryptocurrency enthusiast software intentionally bundling mining tools
level: high
id: 9372a4ae-3b7b-56ee-a16e-7b8423a8aaac
status: experimental
author: Vorant

Suspicious Application Reporting Mining Telemetry to Remote Endpoint

ATT&CK T1071.001

Detects non-mining applications (e.g., calendar, utility apps) making periodic HTTP/HTTPS POST requests to mining monitoring endpoints with telemetry keywords (hashrate, battery, location) - indicative of operator visibility into hijacked resources. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Application Reporting Mining Telemetry to Remote Endpoint
description: Detects calendar, utility, or other benign-appearing applications making
  periodic outbound HTTP/HTTPS requests to domains serving mining telemetry/monitoring
  endpoints, with POST body or User-Agent containing mining-related keywords. Targets
  the pattern where trojanized apps exfiltrate hashrate, battery, and system stats
  to attacker infrastructure.
tags:
- attack.exfiltration
- attack.t1496
- attack.t1071.001
logsource:
  category: network_connection
  product: macos
detection:
  selection:
    Image|endswith:
    - /Calendar.app/Contents/MacOS/Calendar
    - /CalendarFree.app/Contents/MacOS/CalendarFree
    DestinationHostname|contains:
    - /api/mining
    - mining
    DestinationPort:
    - 80
    - 443
  filter_legitimate_calendar:
    DestinationHostname|contains:
    - iCloud.com
    - google.com
    - microsoft.com
  condition: selection and not filter_legitimate_calendar
falsepositives:
- Calendar applications syncing with cloud providers that coincidentally use subdomains
  or paths containing the word 'mining'
level: medium
id: 1df3fa5f-0251-5542-abfb-2a9f16a8a284
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x2B.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free