macOS Screen Sharing Flaw Lets Hackers Mine Crypto on Your Mac

Michael Miller · 2026-08-14

If you've ever used macOS Screen Sharing to remotely access another computer, you might want to sit down for this one. The Netherlands' National Cyber Security Centre (NCSC) just dropped a warning that hackers are actively exploiting a serious authentication bypass vulnerability in macOS. And the kicker? Public exploit code is already circulating, which means the bad guys don't even need to be particularly skilled to get in. This isn't some theoretical threat that might affect you someday. It's happening right now, and the attackers aren't just snooping around. They're using compromised Macs to mine Monero, a privacy-focused cryptocurrency that's become a favorite among cybercriminals because it's hard to trace. In other words, your computer's processing power could be silently siphoned off to line someone else's pockets. ### What's Actually Going On? Let's break this down in plain English. The vulnerability sits in the Screen Sharing feature, which is Apple's built-in tool for remote desktop access. Normally, you'd need to authenticate with a username and password before getting in. But this flaw lets attackers bypass that authentication entirely, giving them a direct path into your system. Once they're in, they don't waste time. They install a Monero miner, which is software that uses your CPU and GPU to solve complex math problems in exchange for cryptocurrency. The miner runs quietly in the background, eating up your processing power and jacking up your electricity bill, while you go about your day completely unaware. The NCSC didn't mince words about the severity. They're urging all macOS users to patch their systems immediately. If you're running an older version of macOS that doesn't have the fix available, you might need to consider more drastic measures, like disabling Screen Sharing altogether until you can update. ### Why Should You Care? Here's the thing about crypto miners: they're not like ransomware that announces itself with a scary lock screen. They're designed to be stealthy. You might notice your Mac getting slower or the fan spinning up more than usual, but most people chalk that up to normal wear and tear. By the time you realize something's wrong, the attacker could have been mining for weeks or even months. There's also the bigger picture to consider. If a hacker can bypass authentication on Screen Sharing, what else can they do? Once they have a foothold, they can potentially install other malware, steal credentials, or use your machine as a launching pad to attack other devices on your network. The Monero miner is just the opening act. ### How to Protect Yourself Right Now Don't panic, but do take action. Here's a checklist to tighten your security today: - **Update macOS immediately.** Go to System Settings > General > Software Update and install the latest version. Apple has already released a patch, so there's no excuse to delay. - **Disable Screen Sharing if you don't need it.** Go to System Settings > General > Sharing and turn off Screen Sharing. If you rarely use it, keeping it off eliminates the attack surface entirely. - **Check for unusual activity.** Open Activity Monitor and look for processes that are eating up CPU or GPU. If you see something you don't recognize, Google it or run a malware scan. - **Use a firewall.** Enable the built-in macOS firewall under System Settings > Network > Firewall. It won't stop everything, but it adds another layer of friction for attackers. - **Change your passwords.** If you've used Screen Sharing recently, change your account password and consider enabling two-factor authentication for your Apple ID. ### The Bottom Line This vulnerability is a stark reminder that no operating system is invincible. macOS has a reputation for being secure, and for good reason, but it's not immune to flaws. The fact that exploit code is already public means the window for patching is closing fast. Every day you wait, you're rolling the dice. If you're a professional who relies on remote access tools, this is especially critical. Your machine holds sensitive data, client information, and credentials that could be worth far more than a few dollars in Monero. Don't let a crypto miner be the least of your worries. Take ten minutes today to update your system and review your security settings. It's a small investment of time that could save you from a massive headache down the road. And remember, the attackers are counting on you being complacent. Prove them wrong.