Mac Users Fall Victim to Critical Screen Sharing Flaw, Monero Mining Malware Deployed

Cybercriminals have exploited a critical macOS security flaw to hijack thousands of Mac systems and deploy Monero cryptocurrency mining malware. The vulnerability, designated as CVE-2026-65400, was discovered in Apple's Screen Sharing functionality and allowed attackers to gain full control of internet-exposed Macs.

The Dutch National Cyber Security Centre verified the attacks, which targeted systems with port 5900 accessible online. Apple released security patches on August 6 for macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, but traditional mitigation methods like password resets are ineffective against this exploit.

CISA elevated the severity rating to 9.8 critical from its initial 7.1 assessment, acknowledging that exploitation requires neither elevated privileges nor user interaction.