Mac Users Exposed to Critical Vulnerability as Hackers Mine Monero on Affected Macs

A critical macOS vulnerability has been exploited by hackers to mine Monero cryptocurrency on affected Macs.

The issue, tracked as CVE-2026-65400, allows remote attackers to execute code without valid credentials and gain root access to the system. The flaw is in the state management mechanisms behind Apple's built-in Screen Sharing feature, which uses the VNC protocol to let one computer view and control another over a network.

The Netherlands' National Cyber Security Centrum (NCSC) confirmed active exploitation of the vulnerability on systems where port 5900 was reachable from the internet. Attackers who exploited the bug installed Monero crypto miners on affected Macs, with no indication that they used the exploit to deploy more damaging malware.

Apple patched the issue last week in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. Users can reduce their risk by disabling Screen Sharing when it's not in use and installing the latest security update.