Hackers Are Abusing a macOS Screen Sharing Flaw to Secretly Mine Monero

In brief

• The Netherlands' NCSC warned of active exploitation of a macOS Screen Sharing vulnerability across systems with port 5900 exposed to the internet, where attackers gained root access and installed Monero mining programs.
• The flaw stems from faulty state management during authentication, letting network attackers log in without valid credentials
• The cryptojacking campaign—which quietly mines privacy coin Monero on victims' hardware—joins a wave of similar schemes.

Attackers have been exploiting a vulnerability in Apple's macOS Screen Sharing feature to seize control of Macs and quietly install cryptocurrency miners, the Netherlands' national cyber agency warned this week.

In an updated advisory, the Dutch National Cyber Security Center, or NCSC, said it received reports of active exploitation across multiple systems that had port 5900, used by Screen Sharing, exposed to the internet.

In each case, the attackers gained root access, the highest level of control over a machine, and planted a Monero mining program to harness the victim's hardware. Monero is a so-called privacy coin, a type of cryptocurrency that cannot be easily traced, unlike transparent networks such as Bitcoin or Ethereum. The agency flagged that public proof-of-concept code for the flaw is now circulating, lowering the bar for would-be attackers.