Hackers have been capitalizing on a critical flaw in Apple’s built-in remote desktop tool to seize control of internet-facing Mac computers and turn them into cryptocurrency mining machines. The Netherlands’ National Cyber Security Centre has confirmed active abuse of the issue, with attackers installing software designed to generate Monero, a privacy-focused digital currency.
The vulnerability, identified as CVE-2026-65400, resides in the Screen Sharing service that ships with macOS.
This feature, which relies on the VNC protocol and listens on TCP port 5900, enables remote viewing and control of a Mac from another device.
Because of inadequate handling of internal state during the login process, an attacker already present on the same network can authenticate successfully without supplying any valid username or password.
Once inside, the intruder gains the ability to run programs, read files, alter settings and, crucially, obtain full administrative privileges.
Apple addressed the problem on 6 August 2026 by releasing emergency updates for three supported operating-system branches: macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9.
The company explained that the fix improves state-management logic so that only legitimate credentials are accepted.
Although Screen Sharing is disabled by default on most systems, it is frequently enabled on servers and “bare-metal” Macs hosted in data centres or remote facilities, leaving those machines reachable from the public internet.
On 12 August the Dutch cyber agency updated its advisory after receiving reports of real-world attacks.
In every confirmed incident, systems that had port 5900 open to the outside world were compromised.
Attackers achieved root-level access and immediately deployed Monero mining software.
The agency has not disclosed how many machines were affected, when the campaigns began, or which threat actors are responsible.
It has also not indicated whether the intrusions have been limited to cryptocurrency mining or whether additional malicious activity has occurred.
Monero is a common choice for illicit mining operations because of its resistance to detection and the relative efficiency of CPU-based mining.
Compromised Macs can quietly consume processing power and electricity while generating coins that are difficult to trace, delivering a steady revenue stream to the attackers with minimal further interaction.
Users and administrators are strongly urged to install the relevant security updates without delay.
Where immediate patching is not feasible, the safest temporary measure is to switch off Screen Sharing entirely through System Settings > General > Sharing. Organizations that rely on remote access should also ensure that port 5900 is not exposed directly to the internet and should place the service behind a VPN or other strong access controls.
The episode underscores the continuing risk posed by remote-access services that remain reachable from the open internet. Even features that are ordinarily switched off can become high-value targets once a bypass is discovered and public proof-of-concept code appears. Prompt application of vendor patches remains the most reliable defense.