Apple's Screen Sharing Flaw Exploited to Mine Monero

A critical macOS vulnerability has been exploited by hackers to mine Monero on open Macs. The Netherlands' National Cyber Security Centre (NCSC) reported that attackers gained root access and installed a Monero miner on exposed Macs connected to the internet.

The vulnerability, known as CVE-2026-65400, was patched by Apple in an update released on August 6 for macOS Tahoe, Sequoia, and Sonoma. The flaw allowed a network-based attacker to bypass authentication via the Screen Sharing service.

Huntress, a security company, noted that changing passwords or disabling accounts does not reduce the vulnerability. They suggested applying Apple's security updates or disabling Screen Sharing until vulnerable hosts can be updated.