Apple Patches macOS Screen Sharing Flaw Exploited for Monero Mining

The Vulnerability and Exploitation

Apple patched a critical authentication flaw in macOS Screen Sharing that allowed attackers to gain root-level access to unpatched systems. According to the Dutch cyber agency, threat actors exploited the flaw to install Monero miners on compromised Macs. Public proof-of-concept code for the vulnerability has since circulated, raising the risk of wider exploitation.

Scope and Timing

The patch addresses a remote code execution vector in Screen Sharing, a built-in macOS feature commonly used for system administration and technical support. The vulnerability required no user interaction once an attacker obtained network access to an exposed system. Apple's patch closes the authentication bypass, though the number of systems compromised before the patch was released remains unclear.

Monero and Cryptominers

Monero, a privacy-focused cryptocurrency, has long been the preferred target for illicit cryptomining operations because its transactions are opaque and exchanges with less rigorous know-your-customer procedures can still cash out the proceeds. The use of compromised computing hardware to mine Monero—rather than Bitcoin or other more-liquid tokens—is consistent with established patterns of cryptojacking campaigns targeting enterprise and consumer systems.