Hackers are exploiting a recently patched macOS Screen Sharing vulnerability to install cryptocurrency miners on internet-exposed Macs, the Netherlands National Cyber Security Centre (NCSC) warns. The flaw is identified as CVE-2026-65400, rated 9.8/10 for severity.
The issue affects macOS’s Screen Sharing component and is described as an authentication weakness. According to the reporting, the problem can be used by an attacker who is already on the same network to gain a foothold and run unauthorized code that deploys a Monero mining payload on compromised systems.
Both outlets report active exploitation in the wild and emphasize the need to update affected macOS installations. While the Hacker News piece focuses on the NCSC alert and the technical framing of the authentication flaw, The Block highlights U.S. officials’ matching severity assessment and broader user guidance. Neither source provides additional details about the threat actors or how widely the infection is occurring.
