Microsoft Threat Intelligence has identified active exploitation of CVE-2026-65400, an improper-authentication vulnerability affecting macOS Screen Sharing. Attackers are abusing the built-in remote-access service to obtain root-level access on a limited number of Mac systems. The activity was detected through Microsoft Defender telemetry showing successful network sign-ins to root accounts via Screen Sharing. Because Screen Sharing is commonly enabled for remote administration and support, exposed systems can become attractive targets when the service is accessible to untrusted networks.

Once authenticated, attackers use the elevated Screen Sharing access to transfer malicious files and establish additional persistence. They copy scripts and an SSH public key to the compromised Mac, providing an alternative method of remote access after the Screen Sharing session ends. Attackers also attempt to reduce forensic visibility by deleting command histories and logs and modify Packet Filter (PF) settings to influence network traffic. The activity demonstrates that the compromise is not limited to unauthorized remote access; root privileges can allow attackers to access protected files, modify system configurations, weaken security controls, and establish long-term persistence.

The attackers ultimately deploy XMRig 6.26.0, a Monero cryptocurrency miner, after renaming and disguising the binary under a system-like path. The malware is further concealed by making its process appear similar to an Apple service. Persistence is established through a LaunchDaemon, allowing the miner to automatically restart when the system loads. Consequently, simply deleting the mining binary may not remove the compromise. Defenders should investigate for unauthorized SSH keys, hidden files, modified PF configurations, suspicious LaunchDaemons, root-level Screen Sharing activity, and unexpected file transfers through SSFileCopyReceiver. Suspicious root SSH sessions occurring after Screen Sharing activity should be treated as potential indicators of compromise.

Organizations should immediately update affected Macs to macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9, disable Screen Sharing when it is not required, and restrict untrusted access to TCP port 5900. Changing only the VNC password is insufficient because it does not address the underlying authorization weakness. Security teams should monitor for CoinMiner detections, suspicious remote-service connections, privileged file writes, unauthorized SSH keys, and LaunchDaemon creation. If compromise is suspected, isolate the affected Mac, preserve relevant logs and configuration evidence before cleanup where possible, remove unauthorized persistence, investigate the full scope of access, and rotate affected credentials after containment. The incident highlights the importance of treating remote-management services such as Screen Sharing with the same security controls, patching, network restrictions, and monitoring applied to internet-facing infrastructure.