Hackers Actively Exploiting macOS’s Built-in Screen Sharing Service Vulnerability in the Wild
Brief
Hackers are actively abusing a flaw in macOS Screen Sharing to take root-level control of a small number of devices.
The attacks turn a built-in remote-access feature into a doorway for quietly placing files, changing system settings, and running a cryptocurrency miner that consumes the victim’s computing power.
The activity matters because Screen Sharing is often enabled for remote support and administration.
An intruder who reaches the exposed service can move from an authenticated connection to privileged access, then leave behind tools that survive restarts and make a compromised Mac harder to investigate.
Microsoft Threat Intelligence identified the activity after Microsoft Defender telemetry recorded successful network sign-ins to root accounts through Screen Sharing.