A critical vulnerability in Apple's Mac computers has moved from theoretical threat to active exploitation in the real world, with hackers leveraging the flaw to commandeer machines for cryptocurrency mining operations. The Netherlands' National Cyber Security Centre has confirmed that attackers are actively targeting the Screen Sharing vulnerability across multiple Macs connected to the internet, gaining the highest level of system control and deploying Monero-mining malware on compromised devices.
The timing underscores a troubling pattern in cybersecurity: the window between a patch's release and widespread exploitation has collapsed. When Apple first patched the Screen Sharing flaw earlier this month, the technology giant indicated to media outlets that it had no evidence of the vulnerability being exploited beyond controlled testing environments. That assessment has now been rendered obsolete by real-world attacks captured by Dutch authorities, demonstrating how quickly threat actors move to weaponise publicly disclosed security flaws. The vulnerability, designated CVE-2026-65400, affects Apple's built-in Screen Sharing feature, which permits remote access and control of Mac computers. The company distributed patches across its product lineup, including macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9.
The choice of Monero as the malware payload reveals the attackers' strategic thinking about immediate monetisation. Unlike Bitcoin and other high-profile cryptocurrencies that require specialised hardware to mine profitably, Monero was designed to be extracted using standard computer processors, making it ideally suited for hijacking ordinary machines. By compromising unpatched Macs, the attackers essentially convert them into a distributed mining network, quietly consuming processing power and electricity to generate cryptocurrency revenue at the owners' expense. A single compromised machine might generate modest returns, but orchestrating hundreds or thousands of such compromises creates a meaningful income stream for the criminals orchestrating the campaign.
Threats specialists caution, however, that cryptocurrency mining may represent only the visible portion of the attack. Tom Hegel, a researcher at SentinelOne's threat research division, explains that while miners serve as an obvious and relatively automated monetisation avenue, the underlying root-level access grants attackers far broader capabilities. With complete control over a system, threat actors can excavate sensitive files, harvest stored credentials, extract cloud authentication tokens, and pivot to connected networks and services. The mining operation essentially functions as a smokescreen, obscuring potentially more damaging activities occurring simultaneously on the victim machine.
Mac users who have delayed updating their operating systems now face considerably sharper pressure to act. The straightforward path to protection involves navigating to System Settings, selecting General, then Software Update to retrieve the latest patches. Those who have no practical need for Screen Sharing functionality can take an additional defensive step by disabling the feature entirely through the same settings menu, specifically under General > Sharing, eliminating the attack vector altogether regardless of other security measures.
Organisations managing large Mac deployments face more complex remediation requirements. Although applying the patch closes the vulnerability itself, security researchers caution that patching represents only the first step in recovery. Any Mac that had Screen Sharing enabled and exposed to the internet before receiving the patch may have already fallen victim to compromise. Hegel advises business technology teams to conduct comprehensive forensic reviews of potentially vulnerable systems to determine whether attackers had already established access, installed persistent malware, or exfiltrated sensitive information. Remediation therefore extends beyond the simple act of updating software to encompassing detection and removal of any malware that may have already taken root.
The scope of potential exposure varies considerably depending on network configuration. The documented attacks in the Netherlands targeted Macs whose Screen Sharing ports were accessible directly from the public internet, a situation that proves less common than might be assumed. Most residential internet routers and corporate firewalls implement blocking rules that prevent such inbound connections by default, meaning that the typical home or office Mac enjoys inherent protection from this particular attack vector unless users have explicitly opened their network to accommodate remote access. Nevertheless, the subset of users and organisations that have intentionally exposed Screen Sharing ports to facilitate legitimate remote work arrangements now face heightened risk.
The federal government's severity assessment of this vulnerability reflects the profound danger it represents. Cybersecurity evaluators have assigned it a critical severity rating of 9.8 out of 10, a score that acknowledges the flaw's exceptional exploitability. The vulnerability requires neither valid user credentials nor any form of user interaction to leverage, meaning an attacker who can reach a vulnerable Screen Sharing port can simply trigger the exploit without needing to deceive a user into clicking a malicious link or opening a compromised file. This combination of characteristics—unauthenticated access, zero user interaction required, and direct system compromise—elevates the threat significantly above typical vulnerability scenarios.
Apple's decision to release this patch outside its ordinary update cycle itself signalled to security professionals that the company viewed the situation with unusual urgency. Vendors typically issue security updates on predictable schedules, clustering multiple patches into larger releases. Breaking that pattern by pushing an unscheduled patch suggests that Apple's own threat intelligence indicated the flaw posed immediate danger to real users. The subsequent confirmation from Dutch cybersecurity officials that attackers have already weaponised the vulnerability vindicates that cautious posture.
For Malaysian users and the broader Southeast Asian technology landscape, this episode carries particular resonance. The region's technology adoption has accelerated dramatically, with Mac usage increasing among creative professionals, software developers, and knowledge workers. Many Malaysian and Southeast Asian companies have adopted remote work practices that may rely on Screen Sharing or similar tools for operational continuity. The vulnerability serves as a timely reminder that emerging markets cannot assume they receive less attention from organised cybercriminals; attackers operate globally and indiscriminately, exploiting vulnerabilities wherever they find vulnerable systems. The incident also underscores the importance of maintaining rapid patch deployment workflows and conducting security audits of remote access infrastructure, considerations that apply equally to Malaysian businesses scaling their digital operations.
