- Attackers exploit a macOS Screen Sharing vulnerability to break into Macs and install the privacy coin Monero.
- The Dutch NCSC warns of active exploitation in systems with port 5900 exposed to the internet.
- The flaw allows network attackers to gain root access without valid credentials, according to the advisory.
- Apple has patched the issue in recent macOS updates, but unpatched devices remain vulnerable.
The Netherlands‘ National Cyber Security Center (NCSC) warned this week that attackers are actively exploiting a macOS Screen Sharing vulnerability to seize control of Macs and install Monero miners. The agency received reports of active exploitation across multiple systems with port 5900 exposed to the internet, according to an updated advisory.
In each case, attackers gained root access, the highest level of control, and planted a Monero mining program. Monero is a privacy coin that cannot be easily traced, unlike transparent networks such as Bitcoin.
The bug, tracked as CVE-2026-65400 and rated 7.1 out of 10 in severity, stems from faulty state management during authentication. It lets network attackers log in without valid credentials, accepting attempts that should have been rejected.
Apple patched the issue in macOS Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1. Users who haven’t updated, particularly those with Screen Sharing reachable from the open internet, remain exposed.
Public proof-of-concept code for the flaw is now circulating, lowering the bar for would-be attackers. Monero has long been the coin of choice for cryptojacking, where hijacked machines mine crypto for an attacker who pockets rewards while the victim absorbs electricity costs and degraded performance.
The campaign joins a wave of similar schemes, including pirated copies of “The Odyssey” laced with the wallet-draining Lumma Stealer and Malware pushed through fake CAPTCHA pages. The NCSC suggests users apply Apple’s updates promptly and avoid leaving Screen Sharing accessible from the internet.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
