Active exploitation of macOS screen sharing flaw exposes Macs to crypto miners

Dutch national security officials have issued a warning that a high-severity vulnerability in macOS is under active exploitation, resulting in the deployment of cryptocurrency miners on affected systems. The flaw, identified as CVE-2026-65400, stems from a bug in the operating system's screen sharing capability, specifically within its state management logic. This allows a remote attacker to execute malicious code, gain root access, and install payloads without requiring valid user credentials.

The Netherlands National Cyber Security Centrum (NCSC) noted that in all observed cases of active abuse, the vulnerability was triggered when port 5900 was accessible from the internet. This port is opened by the macOS firewall when screen sharing is enabled. While routers and dedicated firewalls typically block this port by default, misconfigurations or users who explicitly enable screen sharing for remote work can inadvertently expose their machines to the internet. The attackers have so far been observed installing Monero crypto miners, which surreptitiously use the Mac's processing power to generate cryptocurrency for the adversary.

Apple released a patch for this vulnerability last week, covering macOS Tahoe, Sequoia, and Sonoma. The issue was disclosed at the Black Hat security conference, with credit given to security firm Bynario for reporting the bug. Apple described the vulnerability as potentially allowing an attacker without credentials to gain access to a Mac, a description that security experts note is consistent with the severity rating of 7.1 out of 10.

For developers and technical users, the primary mitigation is to ensure the latest security updates are installed. However, configuration hygiene is also critical. Security practitioners advise keeping port 5900 closed even when screen sharing is needed, recommending the use of VPNs or SSH tunneling for remote access instead. For general users, the safest practice is to disable screen sharing in System Settings > General > Sharing unless it is actively required, and to turn it off immediately after a session ends. Although current exploitation is limited to crypto mining, the potential for more malicious payloads, such as credential stealers or persistent malware, remains a significant risk for unpatched systems.