Critical macOS Screen Sharing Vulnerability Actively Exploited

Key Takeaways

• A critical vulnerability, CVE-2026-65400, in macOS Screen Sharing is being actively exploited in the wild.
• Attackers are gaining root-level control over affected macOS devices.
• The exploit allows for file manipulation, system setting changes, and the deployment of cryptocurrency miners.
• The vulnerability stems from an improper authentication weakness in the Screen Sharing service.
• Immediate application of security updates and proactive monitoring are crucial for mitigation.

Hackers Actively Exploiting macOS’s Built-in Screen Sharing Service

Cybersecurity researchers have uncovered active exploitation of a severe vulnerability within Apple’s macOS Screen Sharing feature, designated as CVE-2026-65400. This flaw, characterized as an improper authentication weakness, allows attackers to escalate privileges and gain root-level control over a limited number of compromised macOS systems. The attacks leverage the operating system’s native remote access capabilities to establish persistent footholds, deploy malicious payloads, and conduct covert operations.

The exploitation chain begins with an intruder accessing the Screen Sharing service, which is frequently enabled for legitimate remote support and administrative functions. Once an authenticated connection is established, the vulnerability permits the attacker to transition from user-level access to full root privileges. This elevated access enables the silent placement of files, alteration of system configurations, and the installation of cryptocurrency mining software, which then siphons off the victim’s computational resources.

Microsoft Threat Intelligence Uncovers Campaign

The active exploitation was initially identified by Microsoft Threat Intelligence. Their analysis, based on telemetry data from Microsoft Defender, revealed successful network sign-ins to root accounts via Screen Sharing. Microsoft Threat Intelligence said in a report shared with Cyber Security News (CSN) that organizations should prioritize security updates and scrutinize related alerts. This advisory follows previous warnings regarding an earlier Apple Screen Sharing vulnerability that allowed for privileged file access and writes through file-copy utilities.

Post-Exploitation Tactics and Persistence

Following successful exploitation, attackers use the Screen Sharing connection to transfer their tools. This includes copying malicious scripts and an SSH public key to the compromised device. The SSH key serves as an alternative access method, ensuring persistent remote access even after the initial Screen Sharing session concludes. The attackers then meticulously erase command histories and logs, hindering forensic investigations. Furthermore, they modify Packet Filter settings, potentially altering network traffic handling on the compromised host. These actions suggest a deliberate and sophisticated intrusion, far beyond a simple opportunistic attack.

The core issue lies in the elevated permissions associated with the Screen Sharing service. Previous research has indicated that legacy VNC authentication mechanisms can allow Screen Sharing’s file-copy components to operate with root authority. This enables attackers to read sensitive protected files or write arbitrary files to critical system locations.

For organizations, the risks extend beyond merely slowed performance due to a cryptocurrency miner. Root access grants an attacker the ability to inspect critical configuration files, establish additional remote access, weaken existing security controls, and utilize the compromised device as a pivot point for further network infiltration. Any unexplained root SSH sessions observed after Screen Sharing activity should be treated as a potential security incident, not a routine support event.

Miner Persistence and Response

The ultimate payload delivered in these attacks is XMRig 6.26.0, a popular Monero cryptocurrency mining software. Attackers cunningly copy and rename the miner to “sysmond” and apply an ad-hoc signature before concealing it within a system-like path: /private/var/root/.config/sysmond. <a href="https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/762de495-6d23-495f-a863-9416dd1c335b/Hackers-Actively-Exploiting-macOSs-built-in-Screen-Sharing-Service-Vulnerability-in-the-Wild.pdf?AWSAccessKeyId=ASIA2F3EMEYEZH4LQP3F&Signature=meR9T2vCZyDOFuynVyE0bi2XAss%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEKz%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJIMEYCIQDYRm6WpmQ%2BgdhXqiVuAMcJTSxUYC7wyHVxhxgU29XEXQIhAJhLgBQTrpbtI3G6IemvWWof3u3939P9MXFL%2BjqlXfQhEKvMECHQQARoMNjk5NzUzMzA5NzA1IgxrgJwH253A9Q

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.