hacker-news Aug 15, 2026 · Crawled Aug 17, 2026

Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner

1 Malware

AI Summary

A critical authentication vulnerability in Apple macOS Screen Sharing, tracked as CVE-2026-65400 (CVSS 9.8), is under active exploitation to deploy Monero cryptominers on internet-exposed Mac systems. The flaw allows unauthorized remote authentication to the Screen Sharing service without valid credentials, enabling attackers to gain root access and install malware. The Netherlands NCSC reported confirmed attacks where systems with port 5900 exposed were compromised. Apple has released emergency patches in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. A separate but related pre-authentication flaw in the same component was also patched, both residing in the same codebase and exploitable with minimal effort.

AI-extracted · verify before operational use

Extracted Entities 1 found

Malware Monero Miner →

MITRE ATT&CK TTPs 7 techniques

T1021.003 Distributed Component Object Model · Lateral Movement T1059 Command and Scripting Interpreter · Execution T1078 Valid Accounts · Defense Evasion T1078.001 Default Accounts · Defense Evasion T1210 Exploitation of Remote Services · Lateral Movement T1484.001 Group Policy Modification · Defense Evasion T1496 Resource Hijacking · Impact