The macOS Screen Sharing Flaw That's Fueling a New Wave of Crypto Mining

Michael Miller · 2026-08-14

When you think about macOS security, you probably picture a walled garden. It's one of the reasons so many professionals stick with Apple. But that wall has a crack, and hackers are actively squeezing through it right now. The Netherlands' National Cyber Security Centre (NCSC) just issued a warning: a serious authentication bypass in macOS Screen Sharing is being exploited in the wild. The scary part? Public exploit code is already out there, which means even less skilled attackers can jump on board. If you're running a Mac, this isn't just a theoretical risk anymore. ### What's Actually Happening The vulnerability lets an attacker bypass the login screen on a Mac that has Screen Sharing enabled. Once they're in, they don't just poke around. In the attacks observed so far, they're deploying a Monero miner. That's a cryptocurrency miner that quietly eats up your CPU and electricity, sending the profits to the attacker's wallet. Think of it this way: someone slips into your car while you're at the grocery store and installs a device that idles the engine for days. You don't notice until your gas bill spikes and your car feels sluggish. That's exactly what's happening to these Macs. ### Why This Matters for You Here's the thing: this isn't a niche issue. Screen Sharing is a built-in feature, and plenty of businesses enable it for remote work. If you're in a small agency, a dev shop, or even a solo operation, your Mac could be exposed. The NCSC specifically notes that this flaw is being actively exploited, which is a huge red flag. It's also a reminder that no operating system is immune. macOS has a reputation for being safer than Windows, but that reputation doesn't hold up when exploit code goes public. The moment that happens, it's a race between hackers and system administrators. ### What You Can Do Right Now Let's get practical. Here are a few steps you can take to protect your machines: - **Disable Screen Sharing** if you don't absolutely need it. Go to System Settings > General > Sharing and turn it off. - **Update macOS immediately**. Apple has released patches for this flaw, so check for updates today. - **Use a firewall** to restrict incoming connections to only trusted IP addresses. - **Monitor CPU usage** for unusual spikes. Monero miners are greedy, and they'll max out your processor. - **Switch to a VPN** for remote access instead of exposing Screen Sharing to the internet. ### The Bigger Picture This attack is a perfect example of why security professionals are turning to more robust tools for identity and access management. It's also why we talk so much about antidetect browsers in certain circles. The idea is simple: don't make yourself an easy target. Whether it's masking your digital fingerprint or locking down your network, the goal is to stay off the radar. If you're managing a team, this is a good time to audit your remote access policies. Ask yourself: who really needs Screen Sharing enabled? Do they need it from outside the office? If the answer is no, shut it down. If the answer is yes, make sure those connections are encrypted and monitored. The NCSC's warning should be a wake-up call. Cybercriminals are getting faster, and they're not picky about their targets. A small business Mac is just as valuable to them as a corporate server, especially if it has a decent processor. ### Final Thought Don't wait for the worst-case scenario. Take ten minutes today to check your settings and update your software. It's a small effort that could save you from a slow, expensive machine and a nasty surprise on your utility bill. Stay sharp, and keep your Mac locked down.