Key facts
- Hackers are exploiting a macOS Screen Sharing vulnerability to mine Monero.
- The flaw allows network attackers to gain root access without valid credentials.
- Systems with port 5900 exposed to the internet are particularly vulnerable.
- Apple has released patches for the vulnerability in recent macOS updates.
- Monero is a privacy coin often used in cryptojacking schemes.
Hackers are actively exploiting a vulnerability in Apple's macOS Screen Sharing feature to gain control of Macs and secretly mine the privacy coin Monero. The Netherlands' National Cyber Security Center (NCSC) issued a warning, noting that systems with port 5900, used by Screen Sharing, exposed to the internet were targeted. Attackers were able to achieve root access, the highest level of control, and install cryptocurrency mining software.