Cybercriminals Exploit macOS Vulnerability to Mine Monero

Cybercriminals Exploit macOS Screen Sharing Flaw

The Dutch National Cyber Security Center (NCSC) has issued a warning regarding a significant vulnerability in macOS's Screen Sharing feature, specifically affecting systems with port 5900 exposed to the internet. This flaw allows unauthorized root access, enabling hackers to install Monero mining software on compromised devices.

Identified as CVE-2026-65400, the vulnerability stems from poor state management during the authentication process, which permits attackers to bypass standard login credentials. Once they gain root access, they can utilize the victim's hardware to mine Monero, a privacy-focused cryptocurrency that poses challenges for tracking.

Severity and Response

Rated 7.1 out of 10 for severity, this flaw is part of a broader trend of cryptojacking incidents where cybercriminals exploit users' devices for unauthorized cryptocurrency mining. Public proof-of-concept code for this vulnerability is also circulating, raising concerns about potential exploitation.

In response, Apple has released patches for macOS versions Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1 to improve authentication checks. Users, especially those with Screen Sharing enabled on internet-facing systems, are strongly advised to update their software to mitigate risks.

Ongoing Threats

This incident highlights a persistent issue in the cybersecurity landscape, as attackers continuously seek new methods to exploit vulnerabilities for profit. The NCSC has urged users to disable internet access for Screen Sharing to prevent unauthorized access.