macOS Screen Sharing flaw actively exploited for Monero mining

CVE-2026-65400, scored 9.8 out of 10, is a pre-authentication bypass in macOS Screen Sharing that lets any network attacker gain root access without credentials on exposed Macs. The Dutch NCSC has confirmed active exploitation to plant a Monero (XMR) cryptocurrency miner on each compromised machine.

Anatomy of CVE-2026-65400: a pre-auth bypass inside screensharingd

The bug lives in screensharingd, the system daemon that powers Screen Sharing — a remote desktop feature present in every macOS installation. Screen Sharing runs the VNC protocol (Virtual Network Computing) over TCP port 5900 and supports two authentication paths: a native Apple mechanism built on the SRP protocol (Secure Remote Password) and a legacy VNC password path.

SRP is a password-authenticated key exchange designed so neither the password nor any password-equivalent material ever crosses the network. The client proves knowledge of the secret without transmitting it — a complete man-in-the-middle capturing the full handshake gains nothing useful toward cracking the credential. Researchers at Huntress traced the bug to the daemon’s frame-length validator, which erroneously returns a stale success status during the SRP handshake. The screensharingd process interprets that stale status as a completed, valid credential exchange and grants the incoming connection full access — without any actual credential verification having occurred. The authenticated session also runs without the RSA-SRP cryptographic protection it should carry, in a weakened state the attacker controls.

« It works the first time, and works every time, on every unpatched Mac with Screen Sharing enabled. Send one or two packets in the right order and the target grants access. »

Pedro Vilaça (@osxreverser), security researcher

The critical takeaway: this is a pre-authentication vulnerability. The bypass fires before the daemon ever consults VNC passwords, approved user accounts, or any other access control sitting downstream of the authentication state machine. Rotating the VNC password, disabling legacy VNC access, removing approved Screen Sharing users — none of these harden against CVE-2026-65400. The only effective mitigations are patching the machine or disabling Screen Sharing entirely. Researchers also identified a structural amplifier: the helper process SSFileCopySender, which handles file transfers inside Screen Sharing sessions, carries an Apple-signed entitlement called kTCCServiceSystemPolicyAllFiles that bypasses macOS TCC (Transparency, Consent and Control) protections entirely. An unauthenticated attacker who crosses the SRP bypass inherits that permission and can read and write any file on the box — SSH keys, browser cookies, code-signing certificates — without any user prompt.

Timeline: from emergency patch to active exploitation in eight days

The sequence of events illustrates how rapidly vulnerability research now translates into active attacks. On July 27, 2026, Apple shipped macOS Tahoe 26.6, Sequoia 15.7.8, and Sonoma 14.8.8 patching CVE-2026-43760, a separate Screen Sharing flaw discovered by Alfredo Pesoli of Bynario. On July 29, researcher Pedro Vilaça published a post titled « It’s a pre-auth, stupid! » confirming that a pre-auth bug had been partially affected by Apple’s update, alongside an obfuscated proof-of-concept binary.

Between August 1 and 2, researcher bl4sty reverse-engineered Vilaça’s binary, recovered the wire format, traced the bypass to the SRP frame-length validation logic, and built a PoC demonstrating file read/write and remote code execution paths. On August 6, Apple shipped the emergency out-of-band update targeting CVE-2026-65400 (macOS Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9). The same day, Singapore-based firm Calif.io began reverse-engineering the patch and produced a working exploit in roughly four hours using an AI coding agent. On August 8, Calif.io published the PoC and a demo video on X. On August 12, the NCSC updated its advisory to confirm active exploitation in the wild — only four days after the public exploit code appeared.

Why Monero: CPU mining economics and transaction privacy

The choice of Monero (XMR) as the attack payload reflects both technical and economic logic. Monero’s proof-of-work algorithm, RandomX, was explicitly designed to resist ASIC mining hardware by favoring general-purpose CPUs. RandomX generates random programs and executes them in a virtual machine that stresses the same CPU characteristics that Apple Silicon M-series processors handle exceptionally well: L3 cache size, branch prediction accuracy, out-of-order execution depth, and floating-point throughput. An M2 Pro or M3 Max Mac Mini mining headlessly can produce Monero at rates competitive with high-end Ryzen processors, with no specialized hardware investment.

At residential electricity rates, a single compromised Mac produces roughly $3 to $15 per month depending on chip generation and local power costs. The economics only work at scale: an attacker controlling tens of thousands of compromised Macs — Mac mini servers running CI/CD pipelines, cloud macOS compute instances, developer workstations left idling — generates meaningful aggregate revenue while the electricity and hardware depreciation costs are borne entirely by the victim organization. The second factor is traceability. Bitcoin transactions are permanently recorded on a fully public blockchain; every address, every amount, every movement is visible. Monero uses ring signatures to mix a spender’s transaction with decoys, stealth addresses to hide recipients, and RingCT to conceal amounts. This privacy-by-default architecture is precisely why XMR has long been the cryptocurrency of choice for cryptojacking campaigns.

Attack surface and detection indicators

Any machine with Screen Sharing enabled and port 5900 reachable from an untrusted network faces immediate risk. Screen Sharing is disabled by default, but it is commonly enabled on Mac mini hardware used as headless servers, on cloud-hosted macOS instances provisioned with default images that include Screen Sharing, and inside iOS/macOS CI/CD build farms. Huntress flagged that, as of early August 2026, several cloud Mac providers had not yet integrated Apple’s August 6 emergency update into their default provisioning images — newly instantiated Macs were being delivered vulnerable.

For security teams, the indicator of compromise published by Huntress concerns the authentication type recorded in Endpoint Security logs. Legitimate Screen Sharing connections authenticate using RSA-SRP and appear as authentication_type: RSA-SRP. Sessions resulting from CVE-2026-65400 exploitation use a degraded authentication type appearing as authentication_type: SRP — by construction a marker of an anomalous session. Administrators should also watch for unexpected new LaunchDaemons under /Library/LaunchDaemons, unfamiliar processes consuming sustained CPU on idle systems, and unexpected outbound connections from otherwise quiet hosts. For systems that cannot be patched immediately, the only effective mitigation is to disable Screen Sharing; blocking port 5900 at the firewall or routing external Screen Sharing through a VPN tunnel offers a substantially safer architecture than direct exposure.

Outlook: the shrinking window between disclosure and exploitation

The confirmed exploitation of CVE-2026-65400 for Monero mining remains opportunistic in nature. The attacks observed by the NCSC targeted systems with port 5900 directly exposed, suggesting automated scanning for vulnerable hosts rather than targeted campaigns. The payload — cryptocurrency mining — generates revenue at scale but does not require precision targeting. However, the root-level initial access obtained gives operators numerous options: credential harvesting, lateral movement, data exfiltration, or resale of access to other threat actors.

The incident underscores a broader trend the cybersecurity industry has been tracking with growing concern: the compression of the timeline from disclosure to weaponized exploit. When a firm can produce a working exploit from public information in four hours using an AI coding agent, the traditional patching windows — often measured in days to weeks — collapse to hours. Organizations that still treat emergency security updates as routine monthly maintenance are operating with a risk model calibrated for a threat landscape that no longer exists. CVE-2026-65400 stands as a concrete warning: the next campaign built on the same technique could pursue objectives far more lucrative than modest CPU mining revenue, and Mac defenders no longer have the luxury of time.

Sources

• The Hacker News — Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner
• Bleeping Computer — Hackers exploit macOS Screen Sharing flaw to deploy Monero miner
• Security Affairs — macOS Screen Sharing Flaw Exploited to Deploy Monero Miners
• SC Media — macOS screen sharing vulnerability actively exploited for crypto mining
• NCSC-NL — Advisory NCSC-2026-0280
• Huntress — Technical analysis of CVE-2026-65400
• Calif.io — No Country for Old Passwords (exploit reverse-engineering)
• Apple — Security Advisory for CVE-2026-65400

This article is published for informational and educational purposes only. It does not constitute investment advice. Do your own research (DYOR) before any decision.