This macOS Screen Sharing Flaw Is Mining Crypto on Exposed Macs

Emily Davis · 2026-08-15

You might think your Mac is safe just because you're not clicking sketchy links or downloading random software. But here's the uncomfortable truth: sometimes the threat doesn't come from you at all. It comes from a feature you probably forgot was even enabled. A recently patched security flaw in Apple macOS has come under active exploitation in the wild to deploy a cryptocurrency miner. The Netherlands National Cyber Security Centre (NCSC) issued the warning, and it's one of those situations where you should probably stop and pay attention. The vulnerability in question is CVE-2026-65400, carrying a CVSS score of 9.8 out of 10. That's about as critical as it gets. This authentication issue impacts the Screen Sharing component, a built-in macOS feature that lets you remotely control another Mac. In theory, it's a handy tool for IT admins and power users. In practice, it's become a gateway for attackers who want to turn your machine into their personal cash cow. ### How the Attack Actually Works Here's the scary part: the attacker doesn't need to trick you into doing anything. They just need to find a Mac with Screen Sharing enabled and exposed to the internet. Once they're on your network, the flaw lets them bypass authentication entirely. That means they can gain full access to your system without a password. Once in, they drop a Monero miner. Monero is a privacy-focused cryptocurrency that's notoriously difficult to trace, which makes it the go-to choice for cybercriminals. Your Mac's processing power gets hijacked, silently churning away at complex math problems to generate coins for the attacker. You won't see anything obvious happening. Your Mac might just feel a little slower, run a bit hotter, or drain its battery faster than usual. ### Why This Matters for Privacy Professionals If you work in digital privacy or manage antidetect browser setups, this should hit close to home. The whole point of tools like antidetect browsers is to control your digital footprint and protect your identity. But if your underlying operating system has a gaping hole, all that careful work goes out the window. An attacker who compromises your Mac doesn't just get your computing power. They get access to your files, your browser profiles, your saved passwords, and potentially your antidetect browser configurations. That's a nightmare scenario for anyone who relies on multiple identities for legitimate business purposes. ### What You Should Do Right Now First, update your macOS immediately. Apple has already patched this vulnerability, but the patch only helps if you actually install it. Go to System Settings, click General, then Software Update. If you've been putting off that update, this is your wake-up call. Second, check whether Screen Sharing is enabled. Open System Settings, navigate to General, then Sharing. If you see Screen Sharing listed and you don't actively use it, turn it off. If you do need it, make sure it's only accessible through a firewall and ideally behind a VPN. Third, audit your network exposure. Use a port scanner to check if your Mac is visible on the internet. If you see port 5900 open, that's the default port for Screen Sharing, and it's a red flag. ### The Bigger Picture This incident is a reminder that no tool, no matter how sophisticated, can protect you if the foundation is cracked. Antidetect browsers are powerful for managing your online presence, but they exist on top of an operating system that needs regular maintenance. Think of it like this: you wouldn't install a state-of-the-art security system in your house and then leave the front door unlocked. Yet that's exactly what happens when people ignore OS updates and leave unnecessary services running. For professionals juggling multiple accounts, ad verification, or market research across different regions, the stakes are even higher. A compromised machine doesn't just affect you. It compromises every identity and every project you've worked on. The good news is that this particular threat is avoidable. Patch your system, disable what you don't need, and stay vigilant. The bad news is that this won't be the last critical flaw discovered in macOS or any other operating system. The attackers are always looking for the next door to kick in. Your job is to make sure yours is locked.