Azure app service is compromised. We can see inside our app service files there is a file called xmrig-6.24.0

Hii @Yale Farmer,

Thank you for contacting us. We have reviewed your issue and found that your Azure App Service has been compromised, with an unauthorized file named xmrig‑6.24.0 added. Based on your screenshots, this file is causing high CPU usage and is consistent with crypto‑mining activity.

The file xmrig-6.24.0 is malware, specifically a widely‑used cryptocurrency mining tool ("XMRig") used by attackers to hijack compute resources.

Please follow the steps to remove XMRig Malware & Secure Azure App Service
Step 1: Stop and clean the App Service

1. Stop the App Service immediately to prevent further CPU drain.
2. Open the Kudu Console → Debug Console → CMD/PowerShell.
3. Delete the suspicious files (e.g., xmrig-6.24.0 folder/files).

Step 2 : Rotate All Credentials

1. Regenerate publishing profile

Azure Portal > App Service > Get Publish Profile > Reset

2. Reset deployment user credentials

Azure Portal > App Service > Deployment Center > User Credentials

3. Reset FTP / FTPS credentials

Portal > App Service > Deployment Center > FTP > Reset

Step 3 :
To safely redeploy after a compromise, delete the entire wwwroot folder from Kudu and then redeploy a clean build of your application using a trusted source such as GitHub Actions, Azure DevOps, or a ZIP package generated from a secure build machine.

You can securing your App Service by using below options:

• Enable Azure Defender: Consider enabling Azure Defender for your App Service. This can help protect against a range of threats, including potential malware and unauthorized access. More information can be found.
• Implement Application Gateway WAF: A Web Application Firewall (WAF) can provide an additional layer of security against web attacks.

Reference:
https://dori-uw-1.kuma-moon.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction#what-are-the-benefits-of-azure-defender-for-app-service
https://dori-uw-1.kuma-moon.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules?tabs=drs21%2Cowasp32
Kindly let us know if the above comment helps or you need further assistance on this issue.

Please "upvote" if the information helped you. This will help us and others in the community as well.