macOS ‘Screen Sharing’ flaw exploited for crypto-mining

The flaw is separate from CVE-2026-43760, a recently disclosed Screen Sharing vulnerability. CVE-2026-43760 requires an attacker to know a configured VNC password, while CVE-2026-65400 can reportedly be exploited before authentication.

Attackers are installing Monero miners

NCSC-NL initially published its advisory on Aug. 7 and updated it on Aug. 12 after reports of active exploitation.

The agency said attacks were observed on multiple systems where port 5900 was directly accessible from the internet. The attackers obtained root access and installed software that used the Macs to mine Monero cryptocurrency.

Cryptojacking malware quietly consumes a device’s processing power to generate cryptocurrency for its operators. Victims may notice excessive CPU use, increased power consumption, overheating or degraded performance.

The miner is only the visible part of the incident, however. Root access gives the attackers control over the entire system. They may be able to steal files and credentials, install additional backdoors, tamper with security tools or use the Mac as a foothold for attacks elsewhere on the network.

NCSC-NL has not disclosed how many systems were compromised, when the attacks began or whether the attackers deployed other malware. Public proof-of-concept code has also been analyzed by security researchers, increasing the risk to Macs that remain unpatched and exposed.

Which Macs are affected?

Apple has released fixes in the following versions:

Earlier versions in these release families should be considered vulnerable. Macs running older, unsupported versions of macOS may not receive the fix and should be upgraded to a supported release.

The most immediate risk applies to Macs that have Screen Sharing enabled and are reachable from untrusted networks, especially systems exposing TCP port 5900 directly to the internet.

Hosted Macs, build servers and remotely administered devices deserve particular attention. Huntress researchers noted that some hosted bare-metal Mac services may provision devices with remote-access services enabled or with older macOS images that remain vulnerable until updated.

How to protect your Mac

Install the latest macOS update

Open System Settings > General > Software Update and install all available updates.

Updating is the only way to correct the underlying authentication flaw. Password changes and account restrictions do not prevent exploitation of CVE-2026-65400 on an otherwise vulnerable system.

Disable Screen Sharing if you don’t use it

Follow Apple’s instructions for changing Sharing settings or go to System Settings > General > Sharing and turn off Screen Sharing.

Organizations should also check whether Remote Management or related remote-access services are enabled through device-management policies.

Keep port 5900 off the public internet

Screen Sharing should not be exposed directly to the internet. Restrict access with a properly configured firewall, a trusted VPN or IP allowlisting.

Administrators should scan their own address ranges for exposed VNC services rather than assuming existing firewall rules are working as intended.

Use a trusted security solution

It’s always advisable to run a trusted security solution on your Mac in case you’re caught off guard. Bitdefender Antivirus for Mac offers real-time protection against malware infection, adware blocking, VPN, protection for all your browsing (including online shopping and banking), and Time Machine Protection for your backed-up files in case of a ransomware attack.

Look for signs of compromise

Based on the detection guidance published by Huntress, warning signs can include:

• Sustained or unexplained high CPU usage
• Unknown processes or startup items
• Connections to cryptocurrency-mining pools
• Unexpected Screen Sharing sessions, especially sessions associated with root
• Newly created LaunchDaemons or modified shell startup files
• Unexplained changes to firewall or remote-access settings

A trusted security solution can help detect cryptocurrency miners, malicious persistence and other suspicious activity. Business administrators should review endpoint security and network telemetry for unusual Screen Sharing activity.

Treat suspected root access as a full breach

Do not simply remove the visible miner and continue using the device. An attacker with root privileges may have installed additional means of persistence that is hard to identify. The safest recovery path generally involves preserving relevant evidence, erasing the Mac and reinstalling macOS from a trusted source.

Credentials, API tokens, SSH keys and other secrets stored on or used from the affected Mac should also be rotated from a device know to be clean.

Most home users face limited immediate risk if Screen Sharing has never been enabled. Anyone operating remotely accessible Macs should act quickly:

• install macOS Tahoe 26.6.1, Sequoia 15.7.9 or Sonoma 14.8.9
• remove port 5900 from the public internet
• investigate exposed systems for signs of earlier compromise

Remember that while patching closes the vulnerability, it does not undo an intrusion that has already happened.

Crypto investment scam sends couriers to collect victims' cash, FBI warns

US indicts three Russians accused of powering global cybercrime

The money trail behind investment scams