Hackers exploit macOS Screen Sharing flaw to deploy Monero miner

The Netherlands' National Cyber Security Centre (NCSC) reports active exploitation of an authentication bypass in macOS Screen Sharing, specifically affecting TCP port 5900. This vulnerability, identified as CVE-2026-65400, allows unauthenticated remote access to the system. Threat actors have leveraged the flaw to obtain root privileges and deploy a Monero cryptocurrency miner. Apple addressed the issue in recent updates, including macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9.