The screen sharing flaw that Apple rushed out a fix for earlier this month has already been exploited in the wild, according to the Netherlands' National Cyber Security Center (NCSC-NL).
On August 6, Apple released macOS Tahoe 26.6.1, an update to the macOS Tahoe operating system that came out last year. The update came a little over a week after Apple released macOS Tahoe 26.6.
In its security support document, Apple said that the update addressed a vulnerability that could allow an attacker to authenticate to Screen Sharing without valid credentials – in short, a bad actor could view a user's Mac screen and remotely take control of their keyboard and mouse. It appears however that hackers have already been taking advantage of the flaw.
As first reported by ArsTechnica, the NCSC-NL said that it had been notified of abuse of the vulnerability, "observed on multiple systems on which port 5900 was accessible from the internet." The reason is that when screen sharing is enabled, macOS's firewall intentionally exposes this port.
"In all these cases, root had been accessed on the affected system and a Monero crypto miner had been placed," the NCSC-NL added. In other words, a targeted Mac's resources are used to mine cryptocurrency.
When pushing the fix – which was also included in macOS Sonoma 14.8.9 and macOS Sequoia 15.7.9 – Apple said it had addressed the authentication issue with "improved state management." Users who have not updated their Macs should do so as soon as possible. Even for those who have updated, use of a VPN is also recommended when screen sharing is active.
If you're not sure if your macOS version is up-to-date, you can check by going into your Mac's System Settings and selecting General ➝ Software Update.
