Cryptojacking

Because RandomX runs well on ordinary CPUs, Monero is the currency of choice for botnets that hijack computers, servers and even IoT devices for covert mining. Campaigns abuse the same open-source tools legitimate miners use — XMRig above all — which is why your antivirus flags it even when you installed it deliberately.

Defence is ordinary hygiene: patched systems, no pirated software, and monitoring for unexplained CPU load. Miners should download tools exclusively from official repositories and whitelist only binaries whose checksums they've verified.