MacOS Vulnerability Exposes Users to Monero Cryptominer Threat

Apple's macOS Screen Sharing feature was recently patched due to a critical vulnerability that allowed attackers to gain full root access and install Monero cryptominers on internet-exposed Macs. The bug, tracked as CVE-2026-65400, was identified by the Netherlands' National Cyber Security Centre (NCSC) after it was exploited in the wild.

The flaw is an authentication bypass that enables attackers to quietly install cryptojacking malware without a username and password. Apple traced the issue to a requirement for Screen Sharing to run on port 5900, which normally requires authentication. The vulnerability has been patched, but users are urged to update their systems and scan for miners.

Attackers used this flaw to gain root access and install Monero cryptominers on multiple Macs, putting user data at risk of theft. Users and organizations should take immediate action to harden remote access and mitigate the crypto security risk.