Apple Patches Critical macOS Flaw After Hackers Exploit Macs to Mine Monero

Apple has fixed a macOS Screen Sharing vulnerability that hackers have been using to mine Monero on open Macs.

An updated warning by the Netherlands’ National Cyber Security Centre said Apple patched a macOS Screen Sharing vulnerability attackers exploited to gain root access and install Monero mining software on exposed Macs connected to the Internet.

On August 12, the Dutch National Cyber Security Centre reported that it had observed CVE-2026-65400 in use, targeting multiple systems connected to the internet through port 5900. In every instance it had seen, the attacker would have had root access and subsequently installed a Monero miner. The NCSC did not say how many devices were affected by the activity, nor did it name a group.

On August 6, Apple released an update for macOS Tahoe, Sequoia, and Sonoma to address the flaw. The Screen Sharing flaw is a state management error that could allow a network-based attacker to bypass authentication via the service.

Security company Huntress reported that a flaw in the SCRAM (Secure Remote Password) authentication mechanism could allow an unauthenticated connection to be treated as an authenticated connection, allowing for a privilege escalation. As the flaw occurs prior to normal authentication, changing passwords or disabling accounts does not reduce the vulnerability.