Hackers Actively Exploiting macOS’s Built-in Screen Sharing Service Vulnerability in the Wild

Hackers are actively abusing a flaw in macOS Screen Sharing to take root-level control of a small number of devices.

The attacks turn a built-in remote-access feature into a doorway for quietly placing files, changing system settings, and running a cryptocurrency miner that consumes the victim’s computing power.

The activity matters because Screen Sharing is often enabled for remote support and administration.

An intruder who reaches the exposed service can move from an authenticated connection to privileged access, then leave behind tools that survive restarts and make a compromised Mac harder to investigate.

Microsoft Threat Intelligence identified the activity after Microsoft Defender telemetry recorded successful network sign-ins to root accounts through Screen Sharing.

The observations show exploitation of CVE-2026-65400, an improper-authentication weakness being used against a limited number of macOS systems.

Microsoft Threat Intelligence said in a report shared with Cyber Security News (CSN) that defenders should apply security updates immediately and review related alerts.

The warning follows reporting on an earlier Apple Screen Sharing vulnerability, where the file-copy helpers could be abused for privileged file access and writes.

Hackers Actively Exploiting macOS’s Built-in Screen Sharing Service

The attackers use Screen Sharing as both the entry point and a channel for transferring their tools.

After signing in as root, they copy scripts and an SSH public key to the device. That key gives them another route back into the Mac after the original Screen Sharing session ends.

They then remove command histories and logs, reducing the evidence available to administrators. The operation also changes Packet Filter settings, which can alter how the host handles network traffic.

These actions give the intrusion a more deliberate footprint than an opportunistic miner dropped by a one-off scam.

The core risk comes from the service’s elevated permissions. Separate research into the feature explains that legacy VNC authentication can leave Screen Sharing file-copy components operating with root authority, allowing protected files to be read or arbitrary files to be written in sensitive locations.

For organizations, exposure is not limited to a slow computer. Root access can let an attacker inspect configuration files, add remote access, weaken controls, and use the device as a foothold.

Administrators should treat unexplained root SSH sessions following Screen Sharing activity as a potential incident, not a routine support event.

Miner Persistence and Response

The final payload is XMRig 6.26.0, software capable of mining the Monero cryptocurrency.

The attackers copy it, rename it, and apply an ad-hoc signature before hiding it under a system-like path. They also make its running process resemble an Apple service, an evasion method seen in other macOS mining campaigns.

To stay active, the intruders create a LaunchDaemon configured to run at load and remain running. That means removing a detected miner alone may not solve the breach.

Investigators must also look for the SSH key, hidden copies, altered settings, and unauthorized persistence that could restore access or relaunch the payload.

Defenders should update affected Macs to at least Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9.

They should disable Screen Sharing where it is not needed, block untrusted access to TCP port 5900, and inspect SSH keys and LaunchDaemons.

Changing only a VNC password is not a complete safeguard against the underlying authorization problem.

Microsoft also advises reviewing detections for CoinMiner malware, suspicious file ingress, and suspicious remote-service connections.

High-confidence hunting combines root-level Screen Sharing transfers through SSFileCopyReceiver with writes to privileged SSH, system configuration, temporary, or LaunchDaemon locations.

If signs of compromise appear, isolate the Mac, remove unauthorized persistence, and rotate affected credentials after confirming the scope. Teams should preserve relevant logs and configuration evidence before cleanup where possible.

The wider lesson is simple: remote-management services deserve the same patching, access restrictions, and monitoring as internet-facing servers.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC