macOS Screen Sharing Flaw Turns Macs Into Silent Crypto Miners

Emily Davis · 2026-08-14

There's a new attack making the rounds that should have every Mac user paying close attention. Security researchers in the Netherlands have flagged an active exploit targeting a macOS authentication bypass vulnerability, and the end goal isn't stealing your files—it's hijacking your computer's power to mine Monero. Here's the deal: the Netherlands' National Cyber Security Centre (NCSC) issued a warning after public exploit code surfaced online. That means the barrier to entry just dropped dramatically. Anyone with basic technical skills can now use this flaw to gain unauthorized access to a Mac's Screen Sharing feature, and that's bad news for anyone running macOS. ### What Is the Screen Sharing Flaw? Screen Sharing is a built-in macOS feature that lets you remotely control another Mac. It's handy for IT teams and folks who need to access their home computer from the office. But this particular vulnerability allows an attacker to bypass the authentication process entirely. They don't need your password. They don't need your approval. They just need your Mac to have Screen Sharing enabled and be reachable over the network. Once they're in, they can do a lot of damage. But instead of stealing your personal photos or banking credentials, these attackers are taking a sneakier route: they're installing a Monero miner. ### Why Monero? Monero is a cryptocurrency designed with privacy in mind. Unlike Bitcoin, transactions are virtually untraceable, which makes it a favorite among cybercriminals. But there's another reason it's the go-to for this kind of attack: it mines efficiently on CPUs. Your Mac's processor is powerful. When an attacker plants a miner on it, they're essentially stealing your computing power to generate coins for themselves. You might notice your fan spinning up for no reason, or your battery draining faster than usual. In some cases, the mining software is so well hidden that users don't notice anything until their electricity bill arrives. ### Who's at Risk? If you've enabled Screen Sharing on your Mac and exposed it to the internet, you're in the danger zone. That's especially true for users who haven't updated to the latest version of macOS. The NCSC is urging everyone to patch immediately. Here are a few quick steps to protect yourself right now: - **Update macOS immediately.** Apple has released a patch, and installing it is the single most effective thing you can do. - **Disable Screen Sharing if you don't use it.** Go to System Settings > General > Sharing and turn it off. - **If you must use Screen Sharing, restrict access.** Only allow specific users and use a strong password. Better yet, set up a VPN so the feature isn't exposed directly to the internet. - **Monitor your system.** Keep an eye on CPU usage. If your Mac is running hot for no reason, that's a red flag. ### The Bigger Picture This attack is a reminder that convenience often comes with hidden costs. Remote access tools are incredibly useful, but they also expand your attack surface. Every feature you leave enabled is a potential doorway for an intruder. What's particularly unsettling here is how quickly the exploit went from theoretical to actively exploited. Public exploit code is like handing a set of keys to every would-be burglar in the world. The moment that code drops, the race is on between attackers and defenders. ### What Should You Do Today? Don't wait. Check your macOS version right now. If you haven't updated in the past week, do it today. It takes a few minutes and could save you from a serious headache down the road. Also, take a second to review your sharing settings. It's easy to enable features and forget about them. A quick audit of your system preferences can go a long way. Remember, attackers aren't just after your data anymore. They're after your hardware's raw power. And they'll take it without asking. Stay sharp, keep your system updated, and don't leave doors open that you don't need. This isn't about being paranoid—it's about being practical. A little bit of effort now can keep your Mac from becoming a silent slave in someone else's crypto mining operation.