macOS Screen Sharing Flaw Exploited to Deploy Monero Miners
Brief
Hackers are exploiting a macOS Screen Sharing flaw to gain root access and install Monero miners on Macs with port 5900 exposed online.
The Dutch National Cyber Security Centre confirmed active exploitation of a critical macOS authentication flaw, tracked as CVE-2026-65400 (CVSS score of 9.8), less than two weeks after Apple shipped the fix.
The bug sits in macOS’s built-in Screen Sharing feature, the remote desktop tool baked into every Mac. Apple’s fix improved how the system manages authentication state, closing a gap that let attackers on the network authenticate to Screen Sharing without valid credentials at all.
Apple patched this issue with the release of macOS Tahoe 26.
- 1 , macOS Sequoia 15.
- 9 , and macOS Sonoma 14.
- 9 , crediting researcher Alfredo Pesoli (@__rev) at Bynario Atlas (bynar. io) for the discovery.