The Netherlands' National Cyber Security Centre (NCSC) has issued an active exploitation warning after threat actors began leveraging a macOS authentication bypass vulnerability in the Screen Sharing service to silently deploy Monero (XMR) cryptocurrency miners on compromised systems. The warning follows the public release of working exploit code, which has significantly lowered the barrier for opportunistic attackers.
The Vulnerability: macOS Screen Sharing Authentication Bypass
The flaw resides in macOS's built-in Screen Sharing service — a remote desktop feature enabled on many Mac systems in enterprise and home environments. The authentication bypass allows remote attackers to connect to a target system's Screen Sharing session without valid credentials under specific conditions, gaining graphical access to the desktop environment.
The Netherlands NCSC's alert notes that the public availability of exploit code has catalyzed active exploitation campaigns. Once attackers gain access through the Screen Sharing bypass, they gain the ability to execute arbitrary commands on the compromised system with the permissions of the targeted user session.
Monero Mining: The Chosen Payload
Rather than deploying ransomware or data-stealing malware — which carry higher detection risk and legal exposure — the threat actors behind this campaign have opted for Monero cryptocurrency mining as their payload. This choice is deliberate:
- Monero is privacy-focused — transactions are untraceable, unlike Bitcoin or Ethereum
- Mining is stealthy — it runs as a background process and may go undetected for weeks or months on lightly monitored systems
- No victim interaction required — the miner runs silently after deployment, requiring no follow-up actions from the attacker
- Scalable revenue — compromising many systems at low individual visibility generates steady cumulative returns
Monero miners deployed through this attack vector consume CPU and GPU resources, causing elevated energy usage, performance degradation, and accelerated hardware wear — but often no obvious indicators that prompt user investigation.
Who Is at Risk
Any macOS system with Screen Sharing enabled and reachable over the network — including over the internet — is potentially vulnerable. Enterprise environments using Screen Sharing for IT support workflows and remote-work setups with Screen Sharing exposed are particularly at risk. Home users who have enabled Screen Sharing for convenience are also targeted.
The attack does not require any interaction from the system owner beyond having Screen Sharing active and network-accessible.
Immediate Mitigation Steps
The NCSC recommends the following immediate actions for all macOS users and administrators:
1. Apply available macOS security updates immediately. Apple regularly patches authentication and remote access vulnerabilities in macOS system updates. Navigate to System Settings > General > Software Update and install all pending updates.
2. Disable Screen Sharing if not actively required.
- Go to System Settings > General > Sharing
- Toggle Screen Sharing off
- Restart the Mac if prompted
3. Restrict Screen Sharing access with a firewall. If Screen Sharing is required, restrict access to known IP addresses using macOS's built-in firewall or a network firewall:
- Block port 5900 (VNC) and port 3283 (Apple Remote Desktop) at the perimeter
- Allow only trusted IP ranges
4. Scan for unauthorized mining processes.
# Check for high CPU consumers (miners typically peg CPU usage)
top -l 1 -n 20 -o cpu
# Look for known miner process names
ps aux | grep -i "xmrig\|monero\|miner\|stratum"
# Check for unusual launch agents/daemons added for persistence
ls -la ~/Library/LaunchAgents/
ls -la /Library/LaunchDaemons/
# Inspect network connections for mining pool communications
lsof -i | grep -E "3333|4444|5555|7777|14433|45700"5. Review recently installed applications and launch agents.
# List recently modified files in LaunchAgents
find ~/Library/LaunchAgents/ -newer /Applications/ -type f
# Check for cron-based persistence
crontab -lIndicators of Compromise
| Indicator | Description |
|---|---|
| Sustained high CPU usage with no obvious foreground task | Monero mining process running |
Process named xmrig, cpuminer, or randomized alphanumeric strings | Common miner binary names |
| Outbound connections to mining pool ports (3333, 4444, 7777) | Active mining communication |
| New LaunchAgent or LaunchDaemon plist files | Miner persistence mechanism |
| Screen Sharing event logs showing unexpected connection attempts | Exploitation attempt evidence |
Broader Context
This incident follows a well-established pattern of attackers targeting remote access services on consumer and enterprise operating systems. macOS has historically been viewed as lower-risk than Windows, but its growing enterprise adoption has made it an increasingly attractive target. The combination of a working public exploit and a stealthy, financially motivated payload (Monero mining) makes this a sustained threat — not a one-time event.
Organizations with macOS fleets should treat this as an urgent patching priority and verify that Screen Sharing is not inadvertently exposed at the network perimeter.