This macOS Screen Sharing Flaw Is Mining Crypto on Your Mac

Michael Miller · 2026-08-14

If you've been noticing your Mac running hotter than usual or your fans spinning up for no apparent reason, there might be a more sinister explanation than just a heavy workload. Security researchers in the Netherlands have uncovered an active campaign where hackers are exploiting a macOS authentication bypass to hijack systems and mine Monero, a cryptocurrency known for its privacy features. The Netherlands' National Cyber Security Centre (NCSC) issued the warning after public exploit code emerged, giving even low-skilled attackers a ready-made tool to break into vulnerable Macs. This isn't a theoretical vulnerability sitting in a research paper—it's being used in the wild right now, and the window to protect yourself is closing fast. ### The Vulnerability Explained At its core, this flaw lives in the Screen Sharing feature of macOS, which is Apple's built-in remote desktop tool. The authentication bypass means an attacker can circumvent the login process entirely, gaining access to your system without needing your password. Once inside, they quietly install a Monero miner, which hijacks your CPU to generate cryptocurrency for them. What makes this particularly nasty is how silent it is. Unlike ransomware that announces its presence or spyware that might cause obvious glitches, a crypto miner is designed to stay hidden. The only telltale signs are often performance degradation, increased power consumption, and higher electricity bills. ### Why Monero Miners Are the Attacker's Favorite Monero is the go-to cryptocurrency for illicit mining operations, and there's a simple reason for that. Unlike Bitcoin, Monero transactions are virtually untraceable, making it nearly impossible to follow the money trail back to the criminals. The mining process itself is also optimized for CPUs, meaning it can run on everyday hardware without raising too many red flags. For the hackers, this is a passive income stream. They don't need to ransom your files or steal your data; they just need your processing power. A single compromised Mac might generate only a few dollars a month, but multiply that by thousands of infected machines, and you're looking at a lucrative operation. ### How to Protect Your Mac Right Now Before you panic, there are concrete steps you can take to lock down your system. Here's a practical checklist to follow: - **Update macOS immediately**: Apple has released patches for this vulnerability, so check System Settings > General > Software Update and install the latest version. - **Disable Screen Sharing if you don't use it**: Go to System Settings > General > Sharing and turn off Screen Sharing. If you need it for work, at least restrict access to specific users. - **Enable a firewall**: Turn on the built-in firewall in System Settings > Network > Firewall to block unsolicited incoming connections. - **Monitor your CPU usage**: Open Activity Monitor and sort by CPU. If you see a process named something like 'xmrig' or 'kdevtmpfsi' eating up resources, that's a red flag. - **Change your passwords**: If you suspect you've been compromised, change your macOS password and any other credentials you use. ### The Bigger Picture This incident highlights a broader trend in the cybersecurity landscape. Attackers are moving away from loud, disruptive attacks toward quieter, more profitable ones. Cryptojacking—the unauthorized use of someone else's computer to mine cryptocurrency—has become a billion-dollar industry, and Macs are no longer immune. Apple has historically enjoyed a reputation for being more secure than Windows, but that's partly because Macs were a smaller target. As Mac market share grows, so does the incentive for hackers to develop exploits specifically for macOS. This Screen Sharing flaw is a wake-up call that no platform is invulnerable. ### What You Should Do Next Don't wait for another headline to remind you to secure your machine. Take the time today to check your update settings, review your sharing preferences, and get into the habit of periodically monitoring your system's performance. A few minutes of proactive effort can save you from the headaches of dealing with a compromised system and the embarrassment of unknowingly funding a criminal enterprise. The hackers behind this campaign are counting on complacency. They're betting that most people won't bother to patch their systems or check their CPU usage. Prove them wrong. Your Mac works hard for you, so don't let it work for someone else's wallet.