The macOS Flaw Hackers Are Using Right Now to Mine Crypto

Michael Miller · 2026-08-14

You might think your Mac is safe from crypto mining attacks. After all, those usually target Windows machines or servers, right? Not anymore. There's a nasty vulnerability floating around in macOS Screen Sharing, and hackers are actively exploiting it to install Monero miners on unsuspecting systems. The Netherlands' National Cyber Security Centre (NCSC) just put out a warning about it, and you need to pay attention. This isn't some theoretical threat from a lab. Public exploit code is already out there, which means even less-skilled attackers can now use it. If you're running macOS and have Screen Sharing enabled, you could be a target. Let's break down what's happening, why it matters, and how to protect yourself before it's too late. ### What's the Vulnerability All About? The issue lies in how macOS handles authentication for Screen Sharing. In simple terms, there's a way for someone to bypass the login process entirely. They don't need your password. They don't need your username. They just need network access to your machine, and they're in. Once inside, they're not interested in your photos or documents. Their goal is much simpler: they want to use your computer's processing power to mine Monero, a privacy-focused cryptocurrency. Mining is resource-intensive, so they hijack your CPU to do the heavy lifting while they collect the coins. You get a slower, hotter Mac, and they get paid. ### Why Monero Miners Are So Popular with Hackers Monero has become the go-to currency for these attacks for a few reasons. First, it's designed to be untraceable. Unlike Bitcoin, where transactions are public, Monero hides the sender, receiver, and amount. That makes it perfect for criminals who don't want to get caught. Second, Monero can be mined efficiently on regular CPUs. Bitcoin mining now requires specialized hardware, but Monero is still accessible to anyone with a decent processor. Your MacBook Pro is actually a pretty good mining rig from a hacker's perspective. They don't care about your electricity bill; they just want the coins. ### Who's at Risk and What's the Damage? This attack specifically targets macOS systems with Screen Sharing enabled. That's a feature many users turn on for remote access, especially in office environments or for IT professionals. If you've ever used it to connect to another Mac on your network, you're potentially exposed. The damage goes beyond just a slow computer. A mining operation will push your CPU to 100% constantly, which generates significant heat. Over time, that can damage your hardware and shorten its lifespan. Plus, your electricity bill will spike because your machine is working overtime. And let's not forget the security breach itself—if an attacker can bypass authentication, they could potentially do other things too. ### How to Protect Yourself Right Now Here's what you need to do today to reduce your risk: - **Disable Screen Sharing** if you don't use it regularly. Go to System Settings > General > Sharing and turn it off. - **Update your macOS** immediately. Apple has likely released a patch or will soon. Check for updates and install them right away. - **Use a strong firewall** to block incoming connections from unknown sources. - **Monitor your CPU usage**. If your Mac is constantly running hot or the fans are spinning loudly for no reason, investigate. - **Enable two-factor authentication** for your Apple ID and any remote access tools. > "The threat is real and active. Don't wait for a patch to be announced—take precautions now." — Security experts advise ### The Bigger Picture This attack is a reminder that no platform is immune. macOS has long had a reputation for being more secure than Windows, but that's not a guarantee. Cybercriminals follow the money, and as Macs become more popular, they're finding ways in. If you're a business owner, this is especially critical. A single compromised Mac on your network could give attackers a foothold to move laterally and access more sensitive systems. Consider this a wake-up call to review your remote access policies and ensure you're not leaving unnecessary services exposed. ### Final Thoughts Hackers are opportunistic. They saw a flaw, they found exploit code, and they're using it before everyone patches. That's the reality of the cybersecurity landscape. Your best defense is to stay informed, stay updated, and minimize your attack surface. Take a few minutes today to check your Screen Sharing settings. It could save you from a serious headache down the road. And if you suspect you've already been compromised, run a security scan and check for unusual processes. Don't let your Mac become a miner for someone else's wallet.