Critical macOS Screen Sharing Flaw Exploited for Cryptojacking

A significant security flaw within macOS Screen Sharing, designated CVE-2026-65400, has been identified and is currently under active exploitation by malicious actors. This critical vulnerability allows attackers to bypass authentication protocols, granting them unauthorized remote root access to affected macOS systems. The severity of this issue has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to issue a high-priority alert, rating the bug with a critical 9.8 on its severity scale.

Reports from the Dutch National Cyber Security Centre (NCSC-NL) indicate that this flaw is being leveraged in real-world attacks, specifically for Monero cryptojacking. In these attacks, threat actors covertly install cryptocurrency mining software on compromised Macs, using the victims' computational resources to generate Monero for their own profit. This not only burdens the affected systems with increased processing load and energy consumption but also poses a significant privacy and security risk as attackers gain deep access.

Users of macOS are strongly advised to take immediate action to mitigate this threat. While official patches or detailed mitigation steps from Apple are anticipated, users should ensure their systems are updated to the latest available versions and consider restricting Screen Sharing access to trusted networks or disabling the service if not essential. The active exploitation underscores the urgency for robust security practices to protect against such sophisticated and impactful cyber threats.