Ethical Hacking News
macOS Screen Sharing Flaw Exploited to Deploy Monero Miners: A Growing Concern for Cybersecurity
A critical macOS authentication flaw (CVE-2026-65400) has been exploited to deploy Monero miners on Macs with port 5900 exposed online. The Dutch National Cyber Security Centre (NCSC-NL) has confirmed the exploitation of this vulnerability, which has a CVSS score of 9.8. Mac users are advised to update to the latest version of macOS, disable Screen Sharing, and ensure that port 5900 is not exposed to the internet. This is a growing concern for cybersecurity, and it is essential for users to take proactive measures to protect themselves.
MacOS authentication flaw (CVE-2026-65400) allows hackers to gain root access and deploy Monero miners on Macs with port 5900 exposed. The flaw lies in macOS's built-in Screen Sharing feature and has a CVSS score of 9.8, making it one of the most critical vulnerabilities in recent times. The attack vectors are remarkably simple and can be exploited using AI coding agents. The exploit allows hackers to gain root access to Macs, which can enable them to install malware, steal sensitive data, or gain access to other devices on the network. nearly 40,000 exposed Screen Sharing hosts were found, highlighting the need for users to secure their Screen Sharing connections. Users are advised to update to the latest version of macOS, disable Screen Sharing, ensure port 5900 is not exposed, and use strong passwords.
The recent discovery of a critical macOS authentication flaw (CVE-2026-65400) has sent shockwaves through the cybersecurity community. The Dutch National Cyber Security Centre (NCSC-NL) has confirmed that hackers are exploiting this flaw to gain root access and deploy Monero miners on Macs with port 5900 exposed online. This malicious activity is a stark reminder of the importance of keeping software up-to-date and taking proactive measures to protect against cyber threats.
The vulnerability lies in macOS's built-in Screen Sharing feature, which allows users to remotely access and control their Macs. The flaw, tracked as CVE-2026-65400, has a CVSS score of 9.8, making it one of the most critical vulnerabilities in recent times. Apple's swift response to this issue, patching the flaw with the release of macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9, has been praised by industry standards. However, this timely patch did not prevent the initial exploitation of the vulnerability.
The attack vectors used by hackers to exploit this flaw are remarkably simple. Security firm Calif, which analyzed the vulnerabilities, discovered that the bugs are triggered by logic errors that allow a couple of correctly ordered packets to bypass authentication. Calif also built a working exploit for both vulnerabilities in about four hours using an AI coding agent, highlighting the growing concern about the ease with which exploits can be created and deployed.
The impact of this exploit is significant, as it allows hackers to gain root access to Macs and deploy Monero miners. While the presence of Monero miners on compromised machines may seem like a minor concern, it is actually a worrying sign. Cryptomining is a relatively low-risk payload compared to the potential consequences of root access on a Mac, which could enable hackers to install malware, steal sensitive data, or even gain access to other devices on the network.
The recent rise in the number of exposed Screen Sharing hosts on the internet has also raised concerns. Security researcher @osxreverser claimed to have found nearly 40,000 exposed hosts during a scan, with nearly half of them in the US. This alarming discovery highlights the need for users to take immediate action to secure their Screen Sharing connections.
In light of this vulnerability, it is essential for Mac users to take the following precautions:
* Update to the latest version of macOS as soon as possible.
* Disable Screen Sharing altogether until the issue is resolved.
* Ensure that port 5900 is not exposed to the internet.
* Use strong passwords and keep them confidential.
The recent discovery of this critical macOS authentication flaw serves as a stark reminder of the importance of cybersecurity. As hackers continue to exploit vulnerabilities and push the boundaries of what is possible, it is crucial for users to stay vigilant and take proactive measures to protect themselves.
Related Information:
https://www.ethicalhackingnews.com/articles/macOS-Screen-Sharing-Flaw-Exploited-to-Deploy-Monero-Miners-A-Growing-Concern-for-Cybersecurity-ehn.shtml
https://securityaffairs.com/197234/uncategorized/macos-screen-sharing-flaw-exploited-to-deploy-monero-miners.html
https://nvd.nist.gov/vuln/detail/CVE-2026-65400
https://www.cvedetails.com/cve/CVE-2026-65400/
Published: Sat Aug 15 21:35:01 2026 by llama3.2 3B Q4_K_M
