# CalendarFree Mac App Hides Crypto Miner

Published: 2026-08-02 · Severity: low
Canonical: https://vorant.io/reports/31453b05-82da-5493-aed9-c35ba55e5f5c/calendarfree-mac-app-hides-crypto-miner

> The macOS calendar app CalendarFree secretly bundles an XMR-Stak-based cryptominer that mines Monero/Graft and phones home mining stats.

Objective-See's analysis dissects CalendarFree.app, a seemingly benign macOS calendar utility that embeds a hidden 'MinerManager' class controlling a bundled XMR-Stak mining framework (identified internally as Coinstash_XMRSTAK). On launch, the app silently starts the miner process via a background dispatch block, configuring CPU core limits, throttling, and connecting to a mining pool to generate Monero (and the Graft cryptocurrency) using a hardcoded wallet/worker identifier.

Static and dynamic analysis (strings, jtool, lldb, procInfo) reveal the miner process 'xmr-stak' launched from within the app's Frameworks directory, connecting to a public mining pool endpoint over port 7777 with attacker-supplied credentials. The app also periodically reports detailed mining statistics (hashrate, battery status, location coordinates, and system telemetry) to a remote endpoint at calendar.qbix.com/api/mining, giving the operator visibility into infected hosts' mining performance and battery/power conditions to potentially throttle mining and evade detection.

This is a commodity cryptojacking case bundled inside a trojanized utility app rather than a targeted intrusion. No specific threat actor is named, and the campaign appears financially motivated, abusing victim CPU resources for cryptocurrency mining while masquerading as legitimate calendar software.

## Mentioned in this report

- Malware: CalendarFree, xmr-stak (Coinstash)

Source reporting: https://objective-see.org/blog/blog_0x2B.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/31453b05-82da-5493-aed9-c35ba55e5f5c/calendarfree-mac-app-hides-crypto-miner.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup