In brief
- The Netherlands' NCSC warned of active exploitation of a macOS Screen Sharing vulnerability across systems with port 5900 exposed to the internet, where attackers gained root access and installed Monero mining programs.
- The flaw stems from faulty state management during authentication, letting network attackers log in without valid credentials
- The cryptojacking campaign—which quietly mines privacy coin Monero on victims' hardware—joins a wave of similar schemes.
Attackers have been exploiting a vulnerability in Apple's macOS Screen Sharing feature to seize control of Macs and quietly install cryptocurrency miners, the Netherlands' national cyber agency warned this week.
In an updated advisory, the Dutch National Cyber Security Center, or NCSC, said it received reports of active exploitation across multiple systems that had port 5900, used by Screen Sharing, exposed to the internet.
In each case, the attackers gained root access, the highest level of control over a machine, and planted a Monero mining program to harness the victim's hardware. Monero is a so-called privacy coin, a type of cryptocurrency that cannot be easily traced, unlike transparent networks such as Bitcoin or Ethereum. The agency flagged that public proof-of-concept code for the flaw is now circulating, lowering the bar for would-be attackers.
The bug, tracked as CVE-2026-65400 and rated 7.1 out of 10 in severity, is an authentication flaw rooted in faulty state management during the login process. It let network-based attackers slip through without valid credentials, accepting authentication attempts that should have been rejected.
