Emerging ThreatsMalware & Ransomware

macOS Screen Sharing Flaw Exploited to Install Monero Miner

Analyst 207||Source: TheHackerNews
Mac computer on a desk with screen sharing active in a home office setting.

"An authentication issue was addressed with improved state management," Apple said in an advisory released on August 6, 2026.

Apple fixes CVE-2026-65400 in emergency macOS updates

Apple published emergency updates this month to address a critical authentication vulnerability in the built-in Screen Sharing component identified as CVE-2026-65400 (CVSS score: 9.8). The fixes were shipped as part of macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9. Apple said the updates "improve state management mechanisms to enforce correct credential validation and prevent unauthorized authentication attempts," and credited security researcher Alfredo Pesoli of Bynario for finding and reporting the issue.

NCSC-NL: internet-exposed Macs being abused to install a Monero miner

The Netherlands National Cyber Security Centre (NCSC-NL) warned that the bug is being exploited in the wild. In an advisory update the agency said it received reports of active abuse across multiple systems where port 5900 (Screen Sharing/VNC) was accessible from the internet. "In all these cases, root had gained access to the affected system and placed a Monero crypto miner," NCSC-NL added. The agency also noted that there are currently no details on when the attacks were observed, the scale of the activity, whether the flaw was exploited as a zero-day, or whether intrusion activity extends beyond cryptocurrency mining.

Two distinct bugs in the same code: legacy VNC path and a pre-auth screensharing daemon flaw

Public technical analysis released after the patches breaks the problem into multiple, related flaws. Pesoli dissected CVE-2026-43760 — one of three additional Screen Sharing bugs Apple fixed — as a post-authentication issue that requires Screen Sharing or Remote Management to be enabled with the "VNC viewers may control screen with password" option set. In Pesoli's account, a legacy VNC authentication path allows a remote viewer to make Screen Sharing read protected files as root, create files as root, and turn a file-copy primitive into remote root command execution: "After the VNC authentication step, we cross a boundary the password was never supposed to cross," Pesoli wrote. "A remote viewer can make macOS Screen Sharing read protected files as root."

By contrast, a researcher using the handle @osxreverser described a separate, pre-authentication vulnerability in the screensharingd daemon that requires only knowledge of the target IP address. That researcher said the bug made it possible to "pwn any Mac that has Screen Sharing enabled without having to know the password or anything else," and that they had not reported it to Apple. Their public posts claimed a scan found "around 40k open screen sharing hosts on the internet, almost half in the U.S., most are residential IPs but there are many juicy hosts in Murican universities, some companies, a server from BBEdit company."

Calif — the firm that published additional details about the Screen Sharing Server defects — emphasized that CVE-2026-65400 is distinct from the pre-auth bug described by @osxreverser, even though both issues live in the same source file. Calif described the pre-auth bug as "a single wrong return" that hands back a success code and advances the authentication state machine; the other problem is a state-machine desynchronization. Both, Calif noted, are logic errors exploitable by sending one or two packets in the right order.

Calif's AI-assisted exploit development and withheld technical details

Calif said it was withholding additional technical specifics about CVE-2026-65400 until a majority of users had upgraded, citing the relative ease with which exploits can be produced using an artificial intelligence (AI) agent. The AI security company revealed it had developed a working exploit for both pre-auth flaws in four hours, and framed this speed as an example of how "AI is collapsing the gap between vulnerability discovery and weaponization."

What this means for technologists, enterprises, and end users

  • Technologists and security teams: Prioritize installing macOS updates that include Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9. Monitor internet-exposed port 5900 on inventory and intrusion-detection systems, and investigate any evidence of root activity or unexpected miners, consistent with NCSC-NL's reports.
  • Enterprises and universities: Review remote-access configurations. The published analysis highlights how legacy VNC settings and exposed remote-desktop services can be escalated to root; Calif and @osxreverser both flagged broad internet exposure, including university hosts, in their public notes.
  • End users and administrators: If immediate patching is not possible, follow the published recommendation to turn off Screen Sharing by navigating to General > Sharing > Toggle Screen Sharing from "Content & Media." Apply the Apple updates when available to restore proper credential validation.

The record in this case is clear on two points: Apple has released patches that modify state management to close an authentication shortcoming, and at least some internet-exposed Macs have been compromised and fitted with a Monero miner. What remains open — and consequential — are the scale and timing of the intrusions, whether additional payloads are in play, and how rapidly automated tools and AI will compress the time between a published flaw and a working exploit. For now, the immediate action is concrete and narrow: apply the updates or disable Screen Sharing on vulnerable machines.

Original story

AppleEmerging ThreatsMacosVulnerability ExploitationMalware OperationsMonero MinerCVE-2026-65400Screen SharingNCSC-NL
Related Intelligence

Continue Reading

Rows of computer servers and storage equipment in a brightly-lit data center with concerned businesspeople in the background.

Clop Ransomware Targets GE, Philips in Data Theft Attacks

Major companies like Philips, General Electric, and Shell are investigating claims by the Clop ransomware gang that their systems were breached, with Philips confirming a contained breach of an internal server that didn't affect customers. The incidents are a stark reminder of the growing threat of ransomware attacks on businesses.

Analyst 207
Blurred employees walk past server racks in a brightly-lit corporate office or data center interior.

Azure Breach Exposes Millions of Employee Records at Top Firms

A threat actor known as TheHatman is peddling a staggering 1.7 million employee records from McDonald's, along with millions more from other top firms, allegedly stolen from Microsoft Azure environments. The breach, which Hudson Rock deems highly authentic, has left giants like Vodafone, Tata Consultancy Services, and IHG Hotels & Resorts vulnerable.

Analyst 207
Person sits at desk with laptop and papers in a neutral setting.

Apple Alerts 110 Countries to Mercenary Spyware Threats

Apple just sounded the alarm for users in 110 countries, warning them they've been targeted by highly sophisticated mercenary spyware attacks that are among the most advanced digital threats out there. This latest alert is part of a multi-year effort to protect users, with notifications now sent to customers in over 150 countries.

Analyst 207
Laptop on a desk in a neutral office setting with blurred screen.

CTM360 Exposes Global Recruitment Phishing Campaign Using Browser-in-the-Browser Traps

Beware of a sneaky recruitment phishing scam that used fake interview pages and a clever Browser-in-the-Browser trick to steal Google and Facebook credentials from over 3,000 unsuspecting victims in just two months. This cunning attack even fooled multi-factor authentication, putting countless users at risk.

Analyst 207