Critical macOS vulnerability turned Macs into hidden Monero mining farms.
My analysis of fresh data from the Netherlands' National Cyber Security Centre (NCSC) has revealed a troubling trend: attackers are actively exploiting a breach in the Screen Sharing component on macOS devices. This is not just about data theft—hackers gain full control over the system and silently deploy Monero (XMR) miners, using victims' computing power to mine cryptocurrency.
Based on available information, the attacks are targeted in nature, but the exact number of victims and the scale of the groups remain classified. It is important to highlight the evolution of the threat: initially, CVE-2026-65400 received a rating of 7.1 out of 10 from the U.S. Cybersecurity and Infrastructure Security Agency (CISA), but within 48 hours, the assessment was revised to a critical 9.8 points. This is a rare case where the severity of a vulnerability is so quickly revised upward.
Technically, the breach allows a remote attacker to bypass authentication and gain access to a Mac via Screen Sharing. Although the "screen sharing" feature is disabled by default, it is widely used by IT administrators and advanced users for remote administration, creating a vast attack surface. My fellow researcher Ryan Daud from Huntress conducted a scan via Censys and found tens of thousands of potentially vulnerable hosts worldwide—this is not a theoretical threat, but a real epidemic.
Apple has already released fixes in the macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9 updates. However, my experience suggests that even after patches are released, a significant portion of users continues to operate on unpatched systems, especially in the corporate segment, where updates are often delayed.
Notably, this is not the first time macOS has been in the crosshairs. Earlier this year, the AI model Claude Mythos helped "white hat" hackers bypass Apple's Memory Integrity Enforcement mechanism, demonstrating a systemic problem: even the most protected platforms are vulnerable to targeted attacks.
My verdict: if you use Screen Sharing—install updates immediately. Otherwise, your Mac may quietly work for someone else's crypto farm, and your data may fall into the wrong hands. The XMR market and its anonymity continue to attract cybercriminals, and this attack is a stark reminder that security should be priority #1 for every holder of crypto assets.