cyberresearch.us

TLP:CLEAR confidence:medium · #cyber-news #critical

Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner

Luke Johnson / Cyber Research US

Summary

Public reporting describes active abuse of CVE-2026-65400, an authentication-bypass issue in built-in macOS Screen Sharing, on hosts that expose the service to the internet. Apple patched the issue on 6 August 2026; the Netherlands NCSC later said it received reports of in-the-wild use that yielded root and a Monero miner. This memo synthesizes those outlets and the NCSC advisory; it is not independent reverse engineering or lab confirmation.

Attack vector

macOS Screen Sharing (remote desktop) speaking VNC over TCP/5900. Preconditions in the reported cases are Screen Sharing enabled and port 5900 reachable from the internet (BleepingComputer, NCSC-NL). A network attacker who can reach that port does not need valid credentials. If the service is off or not internet-exposed, this path does not apply.

Exploit

Bug class is an authentication problem caused by insufficient state management in the Screen Sharing auth flow, so rogue authentication attempts that should be rejected are accepted (NCSC-NL; Apple’s fix is described as improving state management to enforce credential validation). After the bypass, the attacker has remote desktop-equivalent control: open apps, read files, change security settings (BleepingComputer). NCSC states that in observed cases this led to root on the host and placement of a Monero miner. Public exploit code is said to have appeared before the in-the-wild notice (BleepingComputer); sources do not publish a step-by-step PoC, payload names, or how the session is elevated from “unauthenticated Screen Sharing” to root.

In the wild / novelty

Disclosure and patch: Apple fixed CVE-2026-65400 in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9 (6 August 2026 per BleepingComputer). Exploitation claim: NCSC-NL update to NCSC-2026-0280 — a notification of active abuse on multiple systems with 5900 internet-exposed; in all those cases root plus a Monero miner. That is a national-CSIRT victim/incident report, not a honeypot write-up and not a named researcher’s telemetry. Outlets (BleepingComputer 14 Aug 2026; SecurityWeek 17 Aug 2026; The Hacker News) relay NCSC; they do not independently document campaign start date, victim count, or activity beyond mining.

Risk

Internet-facing Macs with Screen Sharing on are the blast radius. Successful abuse is unauthenticated remote control of the desktop, then (as observed) root and covert CPU/GPU use for Monero mining. Same access can change security settings, read local files, and run arbitrary apps — mining is what was reported, not a bound on impact. Identities at risk are local macOS users and any secrets reachable from an interactive/root session.

Remediation

  • Patch to macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9 (Apple via BleepingComputer/NCSC).
  • If you cannot patch immediately: System Settings → General → Sharing → turn off Screen Sharing if unused (BleepingComputer).
  • Do not expose TCP/5900 to the internet; restrict to VPN/management networks and confirm with external port checks.
  • Hunt: unexpected listeners or inbound sessions on 5900; new persistence and high, sustained CPU consistent with a miner; unexplained root-equivalent activity after mid-August 2026 on unpatched, sharing-enabled hosts. NCSC published no IOCs, miner hashes, or C2.
  • Validate: OS build is one of the fixed releases; Sharing pane shows Screen Sharing off unless required; 5900 not world-reachable.

CVE / identifiers

CVE-2026-65400; NCSC-2026-0280. CWE not stated.

Confidence

medium — NCSC, Apple patch list, and multiple news desks agree on vector, CVE, and mining outcome; exploit internals, root path, public-PoC contents, and scale are not specified.

Open questions

When exploitation started relative to the 6 August patch and to public exploit code; how many hosts; whether anything besides a Monero miner was deployed; whether root is inherent to the bypass or a separate post-auth step; miner family, paths, and network indicators (none published).

Sources