Mac Screen Sharing Bug Now Being Exploited to Install Crypto Miners on Exposed Systems

Apple patched a serious macOS security flaw last week. Hackers are already using the un-patched version to take over Macs.

The Netherlands National Cyber Security Centrum (NCSC) says it has received reports of active exploitation on multiple systems where port 5900 was exposed directly to the internet. "In all these cases, root had been accessed on the affected system and a Monero crypto miner had been placed," the agency said this week. Root access means an attacker owns the machine.

What's Actually Broken

The vulnerability, tracked as CVE-2026-65400, carries a severity score of 7.1 out of 10, according to Ars Technica. It lives in macOS's screen sharing feature, the tool that lets someone remotely view and control a Mac's screen, keyboard, and mouse.

The bug comes down to a flaw in state management, the system that tracks what's happened before, what the user is doing, and what state the machine is in. Get that tracking wrong and an outsider can slip in.

Apple's own advisory says the flaw "may" let an attacker without any credentials access a Mac. Ars Technica notes Apple didn't explain why it hedged with "may" instead of stating plainly that it does. That kind of soft language is standard across the tech industry when companies disclose vulnerabilities, but it doesn't do users any favors when they're trying to gauge real risk.

Details of the flaw went public last week at the Black Hat security conference in Las Vegas, one of the industry's biggest venues for researchers to drop new vulnerability disclosures. That timing matters. Once a flaw is public, the clock starts for both defenders and attackers, and this time attackers moved fast.

Who's Actually At Risk

This isn't a doomsday bug for every Mac owner. It only fires when port 5900, the standard screen-sharing port, is exposed directly to the internet.

By default, most home and business routers block that port unless someone has specifically configured port forwarding to open it up. Turning on screen sharing on a Mac opens the port locally, but it takes an extra, deliberate step to expose that port to the wider internet.

This hits people running Mac servers, remote-access setups, or systems administered by IT teams who opened the port for convenience and forgot about it. It's not going to nuke your average MacBook sitting behind a home Wi-Fi router that's never had its firewall touched.

Still, that's cold comfort if you're one of the businesses or admins who did leave it open. Root compromise is root compromise.

What Apple Fixed and What To Do

Apple shipped patches last week for macOS Tahoe, Sequoia, and Sonoma, the three most current versions of the operating system. If a Mac hasn't installed that update, it's still vulnerable.

Security practitioners have long advised against exposing port 5900 to the internet at all, patch or no patch. The recommended alternative is connecting to a Mac remotely through a VPN or SSH tunnel instead of opening screen sharing directly to the outside world. Ars Technica is blunt about the tradeoff here: those safer methods require technical setup that's beyond what most regular users are equipped to do.

For everyday users, the practical fix is simpler. Go to System Settings, then General, then Sharing, and make sure Screen Sharing is toggled off unless it's actively in use. Turn it on only when needed, then turn it back off. And install last week's security update — that part isn't optional.

What Happens If You Get Hit

Right now, the confirmed damage is limited to Monero mining malware. Monero is a cryptocurrency built around anonymity, which makes it the go-to coin for this kind of quiet, background exploitation. The miner hijacks a Mac's processing power to generate coins for the attacker, typically without the owner noticing anything beyond a sluggish machine and a spinning fan.

That's a nuisance, not a catastrophe, compared to what root access could otherwise enable. Whoever's behind this had full control of these systems and chose crypto mining. They could have deployed credential-stealing malware, ransomware, or backdoors instead.

Whether that changes is the open question. Root-level access doesn't expire once the immediate infection is dealt with unless the underlying vulnerability is patched and the systems are checked for persistence. Dutch officials haven't said how many machines were compromised or which sectors were hit, and Apple hasn't released its own count of affected systems either.