macOS Screen Sharing Flaw Exploited to Deploy Monero Miner

Overview of the macOS Screen Sharing Vulnerability

The Netherlands’ National Cyber Security Centre (NCSC) has issued a security warning regarding active exploitation of a critical vulnerability affecting Apple macOS. The flaw resides within the built-in macOS Screen Sharing feature, which permits remote desktop control over a network utilizing the Virtual Network Computing (VNC) protocol over TCP port 5900. According to the advisory published by the agency, network-based threat actors are leveraging this security gap to bypass authentication checks entirely, granting them unauthorized entry to targeted machines without requiring valid user credentials.

Apple addressed this security issue, tracked as CVE-2026-65400, on August 6 in macOS Tahoe 26.6.1 and subsequent releases. The vulnerability stems from improper state management mechanisms within the screen sharing daemon, which previously failed to enforce correct credential validation rigorously under specific remote connection conditions. This oversight allows rogue authentication attempts to succeed, effectively opening the door to malicious actors scanning for exposed services.

Technical Details of Active Exploitation Campaigns

Initial assessments of the vulnerability highlighted the theoretical risk of remote application execution, file modification, and unauthorized security configuration changes. However, recent updates from the NCSC confirm that malicious exploitation is actively occurring in the wild. As detailed by BleepingComputer, the Dutch agency received incident reports confirming active abuse on multiple internet-facing systems.

In all observed exploitation cases, the attack chain followed a consistent pattern centered around internet exposure and post-compromise activity:

• Initial Access: Attackers scanned for infrastructure with TCP port 5900 exposed directly to the public internet, allowing direct access to the VNC service without network-layer perimeter protections like a Virtual Private Network.
• Authentication Bypass: The vulnerability was triggered to bypass login prompts, granting unauthorized administrative sessions to the host operating system.
• Privilege Escalation & Persistence: Threat actors successfully escalated their privileges to obtain root access on the compromised macOS systems.
• Payload Deployment: The attackers installed and executed a Monero cryptocurrency miner, consuming host resources to generate illicit revenue while maintaining persistent background processes.

While current reports specifically emphasize cryptojacking operations involving Monero mining payloads, security researchers caution that unauthorized root access provides attackers with the capability to perform arbitrary system modifications, install secondary malware, or harvest local credentials.

Detection and Investigation Guidance

Defenders investigating potential compromise or searching for indicators of unauthorized remote access must prioritize environment visibility. When analyzing how to detect CVE-2026-65400 exploit attempts, security teams should focus on network perimeter logs and host-based artifacts:

• Network Traffic Analysis: Inspect firewall and NetFlow logs for inbound connections targeting TCP port 5900 from untrusted external IP addresses.
• Process Auditing: Review running background processes and launch daemons for unauthorized binaries associated with cryptocurrency mining frameworks.
• Log Inspection: Examine system authentication and unified logs for anomalous Screen Sharing or VNC connection events originating from external IP ranges.

Actionable Mitigation Steps

Organizations and individual users running affected Apple ecosystems must apply defensive mitigations promptly to neutralize the risk of unauthorized access.

1. Apply Security Updates: Upgrade macOS to version 26.6.1 or later to implement the updated state management and credential validation logic provided by Apple.
2. Disable Unused Services: Where immediate system upgrades are not feasible, navigate to System Settings, proceed to General, then Sharing, and disable Screen Sharing entirely if remote desktop functionality is not required.
3. Network Perimeter Controls: Ensure that TCP port 5900 is never exposed directly to the public internet. Restrict remote management traffic to trusted internal networks or secure, encrypted VPN tunnels equipped with multi-factor authentication.

Related: NatJack Attacks: Exploiting NAT Trust in Windows, Linux, macOS, CVE-2024-21319: PeopleSoft Auth Bypass Exploited by ShinyHunters