Hackers Are Abusing a macOS Screen Sharing Flaw to Secretly Mine Monero
Summary
Attackers are exploiting a macOS Screen Sharing authentication flaw (CVE-2026-65400) to gain root access on Macs with port 5900 exposed to the internet and install Monero miners. The Dutch National Cyber Security Center reported active attacks across multiple systems and warned that public proof-of-concept code is circulating, making exploitation easier. Apple has patched the bug in macOS Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1. The issue stemmed from faulty login state handling that let network attackers bypass authentication. Users who have not updated, especially those exposing Screen Sharing publicly, remain at risk. The agency advises installing Apple’s updates promptly and not leaving Screen Sharing open to the internet.
