NewsBite analysis · Security · Security Vulnerability
BleepingComputer
Hackers exploit macOS Screen Sharing flaw to deploy Monero miner
The Netherlands' National Cyber Security Centre (NCSC) has issued a warning about a macOS authentication bypass vulnerability that hackers are exploiting to deploy a Monero miner. This issue arises from the macOS Screen Sharing feature, allowing attackers access without valid credentials if port 5900 is exposed. Users are encouraged to disable Screen Sharing if not in use following the exploit. Apple has released a patch, but reports of exploitation in the wild have emerged.
Act nowConfidence: HighImmediate horizonCybersecurity risk: High
Published 14 Aug 2026, 16:50 UTC1 min read
Visit original article ↗Lead image — BleepingComputer
Summary
TL;DR
- Vulnerability affects macOS Screen Sharing feature via VNC protocol.
- Attackers gain access without valid credentials on exposed systems.
- NCSC reports root access attainment and Monero miner deployment.
- Apple issued a patch on August 6 for CVE-2026-65400.
- Users urged to disable Screen Sharing until systems can be updated.
Interesting facts
- Exploitation of this flaw allows a range of malicious activities beyond mining.
- Multiple systems have reportedly been compromised due to this vulnerability.