Hackers Exploit macOS Screen Sharing Bug to Mine Monero

Hackers are exploiting a newly patched flaw in Apple’s Mac screen-sharing feature to take control of vulnerable computers and secretly mine Monero, according to the Netherlands’ National Cyber Security Centre (NCSC-NL).

The agency confirmed on August 13 that attackers are actively exploiting the vulnerability, tracked as CVE-2026-65400. 

Sponsored

18+ · Gambling involves risk. Play responsibly.

The flaw allows attackers to bypass authentication in macOS Screen Sharing and gain high-level access to affected Macs, which they can then use to install cryptocurrency-mining malware.

The attack is a form of cryptojacking: instead of stealing cryptocurrency from a wallet or exchange, criminals hijack someone else’s computing power and use it to generate crypto.

Apple released an emergency security update on August 6. But Macs that have not been patched — particularly those with Screen Sharing exposed directly to the internet — remain at risk.

How the Mac attack works

The vulnerability affects screensharingd, the macOS component responsible for the operating system’s built-in remote-access feature.

The flaw allows a network-based attacker to get past Screen Sharing’s normal authentication checks without valid credentials. Once access is obtained, attackers can gain root-level control of the Mac and install additional software.