A new vulnerability in Mac's Screen Sharing feature allows attackers to install hidden Monero miners and gain control of affected devices.
The Dutch National Cyber Security Centre (NCSC) has identified a significant vulnerability in Mac devices related to the Screen Sharing feature, which has been exploited by attackers.
This flaw has enabled cybercriminals to gain full control over affected systems, compromising sensitive data and deploying hidden Monero mining software. The extent of the impact, including the number of victims, remains unspecified.
The NCSC's report, issued on August 12, highlighted the threat designated as CVE-2026-65400, which was initially rated 7.1 out of 10 by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Shortly thereafter, the risk rating was escalated to 9.8.
Apple has responded by issuing patches in the latest updates for macOS versions Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. These updates address the security loophole that permitted unauthorized access via Screen Sharing.
While the Screen Sharing feature is usually turned off by default, it is commonly activated for remote access to Apple devices, including through remote servers.
Cybersecurity expert Ryan Dowd from Huntress has urged users to update their macOS promptly, noting that searches on Censys have revealed tens of thousands of devices that could be vulnerable.
This incident follows an earlier breach in May, where an AI model named Claude Mythos aided ethical hackers in circumventing Apple’s Memory Integrity Enforcement, further raising concerns about macOS security.
