Somebody is walking into Macs through the front door and leaving a cryptocurrency miner running on the way out. The Dutch National Cyber Security Centre (NCSC) says it was notified of several such incidents, all of them turning on a flaw in Apple's built-in Screen Sharing service, and all of them ending with the attacker holding root, the highest level of access a Mac has. The warning was summarised by Malwarebytes Labs on August 17.
The bug is tracked as CVE-2026-65400. Apple patched it on August 6. What is new is not the flaw but the fact that it is being used.
A door on port 5900
Screen Sharing is the remote-control feature Apple ships with macOS, and it listens on port 5900. CVE-2026-65400 is an authentication bypass in that service, which means an attacker who can reach the port over the network can connect to it without any valid credentials at all. Once connected, they can see and control the machine, because seeing and controlling the machine is the entire purpose of the service.
Exposure depends on two things. Screen Sharing has to be switched on, and something has to be able to reach port 5900. The systems most at risk are therefore the ones where that port is reachable from the open internet, typically through a router port forward, a public IP address, or a hosting provider's default network setup. Machines reachable only from an internal network are still exposed in principle, but an attacker has to get a foothold on that network first.
Apple describes the fix as "improved state management". Malwarebytes reads that phrasing as pointing to a failure in the authentication flow or in session state validation rather than a break in any cryptography, which is a reasonable inference from Apple's own wording, though Apple has published no further detail.
Mining is the cheap outcome
In the cases the NCSC describes, attackers used their root access to install software that mines Monero. Monero is the usual choice for this because it can be mined on ordinary CPUs and GPUs rather than on the specialised hardware that Bitcoin mining now requires, so any hijacked machine is worth something.
A miner is also the least of what root access buys. The same position allows an attacker to install persistence so they survive a reboot, steal files, harvest credentials and keys, drop further malware, and move to other machines on the same network. A Mac that is quietly running hot is telling you somebody had that option and chose the lazy version of it. Anyone who finds a miner on a machine should assume the rest was available too and investigate accordingly, rather than simply deleting the miner.
Update to 26.6.1, 15.7.9 or 14.8.9
Apple issued the patch for macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9. Installing it is the fix, and on any supported Mac that means System Settings, then General, then Software Update.
If you cannot update immediately, turn Screen Sharing off. It sits in System Settings under General, then Sharing. While you are on that page, check Remote Management as well, which offers a second route to the same kind of remote control and should be off unless somebody is knowingly using it for IT support. Neither is a substitute for the patch, but both close the network path in the meantime.
This is the second macOS privilege problem in as many weeks with a working path to root: a public exploit for a flaw in the macOS printing stack landed on August 10. If your fleet has drifted behind on updates, the gap between "patched" and "not yet" is now being measured by people mining coins on your hardware. Apple's recent WebKit round is worth checking off at the same time.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.