Attackers exploit patched macOS Screen Sharing flaw to deploy cryptominer

Apple's recently patched vulnerability, tracked as CVE-2026-65400, is currently under active attack, allowing malicious actors to bypass authentication in macOS Screen Sharing and deploy cryptominers. The Dutch National Cyber Security Centre (NCSC) confirmed that root access was gained on multiple systems with port 5900 exposed to the internet, leading to the installation of a Monero miner. Apple has released fixes for this issue through macOS Sequoia (15.7.9), Sonoma (14.8.9), and Tahoe (26.6.1).

Users should immediately apply these updates; alternatively, manually disabling Screen Sharing in System Settings can mitigate the risk until patching is complete.