This macOS Screen Sharing Flaw Is Now Being Used to Mine Crypto

Michael Miller · 2026-08-14

You'd think your Mac is safe from crypto miners, but a newly exposed flaw in macOS Screen Sharing is proving otherwise. Security researchers in the Netherlands just raised the alarm about an active exploit that's already making the rounds, and the timing couldn't be worse for anyone who relies on remote access. The Netherlands' National Cyber Security Centre (NCSC) is warning that hackers are actively exploiting a macOS authentication bypass vulnerability after public exploit code emerged. In plain English, that means someone with the right tools can slip past your Mac's login screen and take control of the Screen Sharing feature without your permission. Once they're in, they're not just snooping around—they're installing a Monero miner that quietly drains your CPU and electricity. ### What Exactly Is Happening? The vulnerability sits in how macOS handles authentication for Screen Sharing, a built-in feature that lets you connect to another Mac over the network. Normally, you'd need a valid username and password to get in. But the exploit bypasses that check entirely, giving attackers a free pass. The NCSC spotted this after exploit code was posted publicly, which means it's not just a theoretical risk anymore—it's a live threat. What makes this particularly nasty is that the Monero miner runs silently in the background. You might notice your Mac getting warmer or your fans spinning up, but unless you're actively monitoring system resources, you could go weeks without realizing something's off. The miner uses your processing power to generate cryptocurrency, and the profits go straight to the attacker's wallet. ### Why Should You Care? If you use Screen Sharing for work or personal projects, you're in the crosshairs. This isn't a niche feature—it's a standard tool for IT admins, developers, and anyone who manages multiple Macs. Even if you only use it occasionally, the risk is real. A single misconfigured network setting or an outdated macOS version could leave you exposed. The financial impact is worth considering too. Monero mining can spike your electricity bill by a noticeable margin, especially if the miner runs around the clock. On top of that, there's the performance hit—your Mac will feel sluggish, apps will take longer to load, and you might see random crashes. For professionals who rely on their machines for income, that's a productivity killer. ### How to Protect Yourself Right Now - **Update macOS immediately**: Apple has released patches for this vulnerability, so check System Settings > General > Software Update and install the latest version. - **Disable Screen Sharing if you don't need it**: Go to System Settings > General > Sharing and turn off Screen Sharing. It's the simplest way to close the door. - **Use a strong password**: If you must keep Screen Sharing enabled, make sure your account password is long and unique. Avoid reusing passwords from other sites. - **Monitor system activity**: Open Activity Monitor and look for processes with high CPU usage that you don't recognize. The miner often shows up as a generic name like "mdworker" or "coreaudiod." - **Restrict network access**: Set your firewall to block incoming connections for Screen Sharing unless you're on a trusted network. ### What the Experts Are Saying The NCSC's warning isn't just a routine advisory—it's a call to action. Public exploit code dramatically lowers the barrier for entry, meaning even less-skilled attackers can now pull this off. Security researchers are urging Mac users to patch their systems within 48 hours, and for good reason. The longer you wait, the higher the chance that someone scans your IP address and finds an open door. Here's a sobering thought: this isn't the first time macOS has faced a mining-related exploit, and it won't be the last. Crypto miners are a low-risk, high-reward target for hackers because they don't need to steal your data or hold your files hostage. They just need your computing power, and they'll take it however they can get it. ### The Bottom Line Your Mac is a powerful machine, but that power comes with responsibility. A few minutes of preventive maintenance today can save you from a headache down the road. Update your system, tighten your settings, and keep an eye on what's running in the background. The mining threat is real, but it's also avoidable if you stay one step ahead. If you're managing multiple Macs for a team, this is doubly important. Make sure your IT department is aware of the vulnerability and has a plan to patch every device on your network. Don't assume that a single firewall or an antivirus tool is enough—this exploit targets a core macOS feature, and only a proper update will close the hole. Stay safe out there, and remember: if your Mac feels warmer than usual, it might not be the weather.