Hackers exploit macOS flaw to mine Monero

Hackers are actively exploiting a critical vulnerability in Apple's macOS Screen Sharing feature to take control of exposed computers and secretly install Monero cryptocurrency mining software, according to a confirmed warning from the Netherlands National Cyber Security Centre. The agency stated on August 12 that attackers have successfully compromised multiple systems where the Screen Sharing port was accessible from the internet, gaining root-level access and deploying miners in every observed case.

The flaw, tracked as CVE-2026-65400, involves improper state management in the authentication process for the built-in remote access feature. It allows a network-based attacker to bypass normal credential checks and gain high-level control. Apple released an emergency security update on August 6 to address the issue in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. However, systems that remain unpatched, particularly those with Screen Sharing directly exposed to the internet, are vulnerable to takeover.

Security researchers found that the exploit occurs before standard authentication, making common defensive steps ineffective. Changing the Screen Sharing...