Attackers Exploit macOS Screen Sharing Flaw to Install Crypto Miners

Attackers have been exploiting a vulnerability in Apple's macOS Screen Sharing feature to seize control of Macs and quietly install cryptocurrency miners, the Netherlands' national cyber agency warned this week.

In an updated advisory, the Dutch National Cyber Security Center, or NCSC, said it received reports of active exploitation across multiple systems that had port 5900, used by Screen Sharing, exposed to the internet.

In each case, the attackers gained root access, the highest level of control over a machine, and planted a Monero mining program to harness the victim's hardware. Monero is a so-called privacy coin, a type of cryptocurrency that cannot be easily traced, unlike transparent networks such as Bitcoin or Ethereum. The agency flagged that public proof-of-concept code for the flaw is now circulating, lowering the bar for would-be attackers.

The bug, tracked as CVE-2026-65400 and rated 7.1 out of 10 in severity, is an authentication flaw rooted in faulty state management during the login process. It let network-based attackers slip through without valid credentials, accepting authentication attempts that should have been rejected.

Apple has since patched the issue, tightening its validation checks in macOS Sequoia 15.7.9, Sonoma 14.8.9 and Tahoe 26.6.1. Users who haven't updated, particularly anyone with Screen Sharing reachable from the open internet, remain exposed.

Monero has long been the coin of choice for so-called cryptojacking, in which hijacked machines mine crypto for an attacker who pockets the rewards while the victim absorbs the electricity costs and degraded performance. The token's privacy features make the proceeds far harder to trace than Bitcoin.

The campaign is the latest in a steady stream of schemes turning other people's devices into crypto profit.

Just this month, Bitdefender found pirated copies of "The Odyssey" laced with the wallet-draining Lumma Stealer. Decrypt has also reported on malware pushed through fake CAPTCHA pages routed via BNB Chain, the SparkKitty operation that hid wallet-stealing code in mobile apps, malicious "anime girl" wallpapers aimed at Steam gamers, and crypto-stealing code smuggled into a booby-trapped Python library.

The NCSC suggests users apply Apple's updates promptly and avoid leaving Screen Sharing accessible from the internet, which gave attackers their opening in the first place.