Hackers Exploit macOS Flaw on Port 5900, Planting Monero Miner After Apple’s August 6 Fix
Updated
Updated · BleepingComputer · Aug 14
Hackers Exploit macOS Flaw on Port 5900, Planting Monero Miner After Apple’s August 6 Fix
3 articles · Updated · BleepingComputer · Aug 14
Summary
Dutch cyber agency NCSC said attackers are actively abusing CVE-2026-65400 on internet-exposed macOS systems, gaining root access and installing a Monero cryptocurrency miner on multiple machines.
Public exploit code emerged for the Screen Sharing authentication-bypass bug, which lets network-based attackers log in without valid credentials through Apple’s built-in remote desktop service over TCP port 5900.
Apple patched the flaw on August 6 in macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9; affected users should update or disable Screen Sharing if they cannot patch immediately.
NCSC did not say when the attacks began, how many systems were hit, or whether the intrusions went beyond cryptomining, but the cases all involved systems with port 5900 exposed to the internet.