MacOS Flaw Lets Hackers Mine Monero on Thousands of Devices

A critical macOS vulnerability is allowing hackers to gain unauthorized access to Apple devices and install Monero mining software, leading to resource hijacking and serious performance issues.

The flaw, tracked as CVE-2026-65400, allows attackers to bypass authentication and gain administrative control by exploiting a logic error in the state management system of macOS Screen Sharing.

Cybercriminals are targeting devices with port 5900 exposed to the internet, which can be detected by automated scanning tools in minutes. They then install Monero mining software, taking advantage of the cryptocurrency's proof-of-work algorithm called RandomX, which is optimized for Apple Silicon and modern x86 CPU architectures.

Apple has released emergency security patches for macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9 to close the Screen Sharing vulnerability and prevent unauthorized exploitation. Network administrators are advised to check firewalls and ensure port 5900 is closed to external traffic or turn off Screen Sharing in System Settings.