MACOS SCREEN SHARING FLAW EXPLOITED FOR CRYPTO MINING

The NCSC issued an alert after public exploit code surfaced online, making the vulnerability accessible to a broader range of attackers. The macOS Screen Sharing feature contains an authentication bypass that allows threat actors to gain unauthorized access to affected systems without proper credentials. Once attackers gain access through the vulnerability, they deploy Monero cryptocurrency miners that consume system resources to generate digital currency for the attackers. This type of exploitation represents a growing threat, as cryptominers run silently in the background, degrading system performance while remaining relatively undetected. Screen Sharing, a legitimate macOS feature that enables remote desktop access, becomes a vector for attack when the authentication mechanism fails to properly validate user permissions. The release of functional exploit code accelerates the threat timeline, moving the vulnerability from theoretical risk to active, in-the-wild exploitation. Affected users may experience symptoms including slower system performance, increased CPU usage, and elevated fan activity from their machines working harder than normal. The Monero cryptocurrency was specifically chosen by attackers because it prioritizes privacy and is difficult to trace compared to other digital currencies. Apple has not yet released a patch for the vulnerability. Users should review their Screen Sharing settings and consider disabling the feature if remote access is not required. Network administrators should monitor for suspicious Screen Sharing connections and implement access controls to limit exposure. The NCSC recommends immediate patching once a fix becomes available and suggests organizations review logs for unauthorized access attempts. This incident underscores the importance of securing remote access features, which remain attractive targets for attackers seeking to monetize compromised hardware.