Apple Patched the Door, But Monero Miners Are Still Knocking 🪟

The Dutch National Cyber Security Center (NCSC) warned this week that attackers are actively exploiting a vulnerability in Apple's macOS Screen Sharing feature to seize control of machines and silently install Monero mining software. In an updated advisory, the agency said it received reports of intrusions across systems that had port 5900, used by Screen Sharing, exposed to the internet. In each confirmed case, the attackers obtained root access and deployed a Monero miner to harness the victim's hardware, with the operator pocketing the rewards while the owner absorbed the electricity costs and degraded performance.

The bug, tracked as CVE-2026-65400 and rated 7.1 out of 10 in severity, is an authentication flaw rooted in faulty state management during the login process. It allowed network-based attackers to bypass credential checks by accepting authentication attempts that should have been rejected. The NCSC noted that public proof-of-concept code is now circulating, lowering the barrier for prospective attackers. Monero, a so-called privacy coin, is favored in cryptojacking schemes because its transactions cannot be easily traced, unlike the transparent ledgers of Bitcoin or Ethereum.

Apple has shipped patches tightening the validation logic in macOS Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1. Systems that have not updated, especially those with Screen Sharing reachable from the open internet, remain exposed to the same exploit path. The NCSC urged users to apply the updates promptly and to avoid leaving Screen Sharing accessible from the public internet, the configuration that gave attackers their initial foothold.

The mining campaign is part of a broader pattern of operations turning other people's devices into crypto profit for the operator. Bitdefender found earlier this month that pirated copies of "The Odyssey" were laced with the wallet-draining Lumma Stealer. Separately, malware has been pushed through fake CAPTCHA pages routed via BNB Chain, the SparkKitty operation hid wallet-stealing code in mobile apps, malicious "anime girl" wallpapers targeted Steam gamers, and crypto-stealing code was smuggled into a booby-trapped Python library. The Netherlands' cyber agency reiterated that prompt patching and restricting Screen Sharing to trusted networks are the recommended mitigations against this latest wave.