macOS Screen Sharing: an authentication bypass actively exploited to mine Monero

The Dutch NCSC warns: an active campaign is exploiting a macOS screen-sharing vulnerability to deploy a cryptocurrency miner. The exploit code is public—time to patch.

What

An authentication bypass vulnerability in macOS Screen Sharing functionality is being actively exploited to deploy a Monero (XMR) cryptocurrency miner. The alert comes from the Dutch NCSC (National Cyber Security Centre) - a public exploit code has recently emerged, accelerating ongoing attacks.

Who is affected

All macOS systems with screen sharing enabled and unpatched are potentially exposed. The attack surface notably includes developer workstations and macOS build machines - common targets in tech teams.

Analysis

Cryptocurrency miners are often perceived as “less dangerous” compared to ransomware, but they reveal something more concerning: an unauthorized, full, and reproducible remote code execution capability. An attacker capable of deploying a miner can, through the same vector, deploy any payload: RAT (Remote Access Trojan), infostealer, or ransomware.

The choice of Monero is deliberate: XMR is a privacy-focused cryptocurrency using ring signatures and stealth addresses, which significantly complicates fund tracing and attack attribution.

What to do now

1. Check if Screen Sharing is enabled: System Settings → General → Sharing → disable “Screen Sharing” if not needed.
2. Apply available macOS updates as soon as possible - patching is the only true protection.
3. Audit active processes: a Monero miner consumes CPU massively. Identify unknown processes with high CPU usage via Activity Monitor or top -o cpu in Terminal.
4. Outbound firewall: block connections to known mining pools (ports 3333, 5555, 7777 are frequently used by XMR miners).