Apple Ransomware: macOS Screen Sharing Flaw Exploited for Monero Mining (August 2026)

Apple: What Happened

A critical authentication vulnerability in Apple macOS Screen Sharing (CVE-2026-65400) was actively exploited in August 2026, targeting both Apple as an organization and unspecified Mac users globally. Threat actors leveraged this flaw to gain unauthorized root access to internet-exposed Macs, deploying Monero cryptocurrency miners without user consent. The Netherlands NCSC reported multiple confirmed infection cases, with attackers achieving full system compromise and remote code execution. Emergency patches were issued by Apple in macOS Tahoe 26.6.1 and other versions to address the rapidly escalating threat.

Attack Vector & Technical Detail

The primary attack vector was a remote authentication bypass in macOS Screen Sharing, tracked as CVE-2026-65400. This vulnerability allowed attackers on the network to authenticate without valid credentials, granting them root-level access and the ability to execute arbitrary commands remotely. Additional related CVEs—CVE-2026-43779, CVE-2026-43777, and CVE-2026-43760—were also identified as part of the exploited attack surface. The observed tactics align with MITRE ATT&CK techniques TA0001 (Initial Access), TA0008 (Lateral Movement), and TA0005 (Defense Evasion). The attackers’ deployment of Monero miners indicates a financially motivated campaign, with the potential for further malicious payloads given the level of access achieved.

Confirmed Impact

The exploitation of CVE-2026-65400 resulted in unauthorized root access on tens of thousands of Macs, with infections confirmed across Europe and the United States. The ability to execute remote root commands exposed affected organizations and individuals to significant operational risk, data compromise, and resource hijacking for illicit cryptocurrency mining. Regulatory implications are heightened for organizations subject to data protection laws, as unauthorized access and control could lead to breaches of confidentiality and integrity requirements. The scale of exposure, combined with the critical severity of the vulnerability, underscores the urgent need for remediation.

What This Means for Your Organization

Organizations running macOS systems with Screen Sharing enabled are at immediate risk if patches have not been applied. The attack demonstrates the importance of promptly addressing remote authentication vulnerabilities, especially those allowing root access and remote code execution. It is critical to audit all internet-exposed services, restrict remote access where possible, and deploy emergency patches as soon as they become available. Monitoring for anomalous system resource usage and unauthorized processes can help detect ongoing or future compromise.

Detection & Response

• Immediate: Apply Apple’s emergency patches for macOS Tahoe 26.6.1 and all other affected versions to remediate CVE-2026-65400 and related vulnerabilities.
• Hunt: Investigate systems for evidence of unauthorized root access, unexpected Monero mining processes, and lateral movement consistent with MITRE TA0001, TA0008, and TA0005.
• Patch: Ensure all systems are updated to the latest macOS versions containing the security fixes for CVE-2026-65400, CVE-2026-43779, CVE-2026-43777, and CVE-2026-43760.

Source: https://thehackernews.com/2026/08/apple-macos-screen-sharing-flaw.html