The Netherlands' National Cyber Security Centre (NCSC) is warning that threat actors are actively exploiting an authentication bypass vulnerability in macOS Screen Sharing following the public release of proof-of-concept exploit code. The observed end goal is familiar but damaging: compromised Macs are being conscripted into cryptocurrency mining operations running Monero (XMR) miners — typically XMRig or close derivatives.
Do not let the word "miner" lull you into treating this as a nuisance-grade event. An attacker who can bypass Screen Sharing authentication has interactive, GUI-level access to the target Mac. The miner is simply what they chose to monetize first. The same access supports credential theft, data staging, persistence, and lateral movement. Any organization with macOS endpoints — increasingly common in engineering, design, and executive fleets — needs to validate exposure today.
Technical Analysis
What is affected
The flaw resides in the macOS Screen Sharing service (screensharingd), which implements Apple's VNC-compatible Remote Framebuffer (RFB) server on TCP port 5900. Screen Sharing can be enabled via System Settings → General → Sharing → Screen Sharing, through Remote Management, or programmatically via the ARDAgent kickstart mechanism — which means it is frequently enabled on managed fleets and forgotten.
How the attack works
From a defender's perspective, the attack chain looks like this:
- Discovery. Attackers scan for Internet-exposed or laterally reachable hosts listening on TCP/5900. Shodan-style reconnaissance and internal subnet sweeps both apply here.
- Authentication bypass. Using the publicly released exploit code, the attacker abuses the flaw in the Screen Sharing authentication negotiation to gain a session without valid credentials. No user interaction is required; the target only needs the service enabled and reachable.
- Post-exploitation. With interactive access, the operator drops and executes a payload. Observed deployments are Monero miners — consistent with XMRig-style tooling — delivered via shell commands, curl/wget downloads from attacker infrastructure, and executed from world-writable or user-level directories such as
/tmp,/private/tmp,~/Library/, or/Users/Shared/. - Persistence. Miner deployments on macOS almost universally establish LaunchAgents or LaunchDaemons property lists (plists) under
~/Library/LaunchAgents/or/Library/LaunchDaemons/to survive reboot, frequently masquerading as legitimate Apple or vendor services (com.apple.*naming conventions on non-Apple binaries).
Exploitation status
- Public exploit code: Yes — PoC release is what triggered the NCSC warning.
- Active in-the-wild exploitation: Confirmed by NCSC; opportunistic cryptomining campaigns are the current observed use.
- Attribution: No nation-state linkage reported; this is financially motivated, automated scanning-and-exploitation behavior.
The combination of public PoC plus trivial exploitation requirements means the window between "my Mac has Screen Sharing on" and "my Mac is mining Monero" is now measured in hours for any host reachable from the Internet.
Detection & Response
The detections below target the three most reliable observables from this campaign: (1) the Screen Sharing daemon spawning shells or downloaders, (2) unexpected inbound VNC/RFB connections on TCP/5900, and (3) miner process and persistence artifacts. All three are high-signal and low-noise in any environment that does not legitimately mine Monero.
Sigma Rules
---
title: macOS Screen Sharing Daemon Spawning Shell or Downloader
id: 3c9f2a71-4b6d-4e8a-9c12-7f5d0a2b8e44
status: experimental
description: Detects screensharingd or Apple Remote Desktop agent spawning shells, curl, wget, or scripting interpreters — a strong indicator of post-exploitation following Screen Sharing compromise.
references:
- https://www.bleepingcomputer.com/news/security/hackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner/
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.execution
- attack.t1059.004
- attack.initial_access
- attack.t1133
logsource:
category: process_creation
product: macos
detection:
selection_parent:
ParentImage|endswith:
- '/screensharingd'
- '/ARDAgent'
selection_child:
Image|endswith:
- '/sh'
- '/bash'
- '/zsh'
- '/curl'
- '/wget'
- '/python'
- '/python3'
- '/osascript'
- '/base64'
- '/plutil'
condition: selection_parent and selection_child
falsepositives:
- Legitimate remote administration via Screen Sharing by IT staff executing scripts
level: high
---
title: Inbound Network Connection to macOS Screen Sharing Service
id: 8d1e4b62-7a3c-4f59-b206-9e8c1d4a7f33
status: experimental
description: Detects inbound connections to TCP 5900 (Screen Sharing / VNC RFB). Alert where the source is external or from subnets that should never initiate remote screen sessions.
references:
- https://www.bleepingcomputer.com/news/security/hackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner/
- https://attack.mitre.org/techniques/T1021/005/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.lateral_movement
- attack.t1021.005
logsource:
category: network_connection
product: macos
detection:
selection:
DestinationPort: 5900
Initiated: 'false'
condition: selection
falsepositives:
- Authorized helpdesk and IT remote support sessions
- Jamf / MDM-driven remote management from known admin hosts
level: medium
---
title: Monero Miner Execution Artifacts on macOS
id: 5f7a3c90-2d8e-4b61-a834-6c0f9b2e5d71
status: experimental
description: Detects execution of XMRig and common cryptominer indicators, including stratum mining pool command-line arguments and execution from temporary or shared directories.
references:
- https://www.bleepingcomputer.com/news/security/hackers-exploit-macos-screen-sharing-flaw-to-deploy-monero-miner/
- https://attack.mitre.org/techniques/T1496/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.impact
- attack.t1496
logsource:
category: process_creation
product: macos
detection:
selection_img:
Image|contains:
- 'xmrig'
- 'minerd'
- 'cpuminer'
- 'xmr-stak'
selection_cli:
CommandLine|contains:
- 'stratum+tcp://'
- 'stratum+ssl://'
- '--donate-level'
- '--coin=monero'
- 'pool.minexmr'
- 'xmrpool'
selection_path:
Image|startswith:
- '/tmp/'
- '/private/tmp/'
- '/Users/Shared/'
condition: selection_img or selection_cli or (selection_path and selection_cli)
falsepositives:
- None expected in corporate environments; legitimate Monero mining is exceptionally rare on managed endpoints
level: critical
KQL — Microsoft Sentinel / Defender
If your Macs are enrolled in Defender for Endpoint (or forwarding Syslog/CEF into Sentinel), the following hunt joins the exploitation surface with miner behavior. Run it across at least 14 days — cryptominers are deliberately low-and-slow to avoid CPU-based user complaints.
// Hunt: macOS Screen Sharing exposure, suspicious child processes, and miner indicators
let lookback = 14d;
let MinerIndicators = dynamic(["xmrig", "stratum+tcp", "stratum+ssl", "--donate-level", "minerd", "xmr-stak", "cpuminer", "monero"]);
let SuspiciousParents = dynamic(["screensharingd", "ARDAgent"]);
// 1. Shells or downloaders spawned by Screen Sharing components
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName has_any (SuspiciousParents)
| where FileName in~ ("sh", "bash", "zsh", "curl", "wget", "python", "python3", "osascript", "base64")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, SHA256
| order by TimeGenerated desc;
// 2. Miner process or mining-pool command-line indicators on macOS endpoints
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where ProcessCommandLine has_any (MinerIndicators) or FileName has_any (MinerIndicators)
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, FolderPath, SHA256, AccountName;
// 3. Inbound connections to VNC/Screen Sharing from remote hosts
DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where LocalPort == 5900
| where not(RemoteIP startswith "10.") and not(RemoteIP startswith "192.168.") and not(RemoteIP startswith "172.16.")
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, RemoteIP, RemotePort
| order by Connections desc;
Velociraptor VQL
For live macOS fleet hunting, this artifact combines miner process detection with LaunchAgent/LaunchDaemon persistence review — the two artifacts that survive longest after a Screen Sharing compromise.
-- Hunt for cryptominer processes and suspicious launchd persistence on macOS endpoints
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'xmrig|stratum\+tcp|stratum\+ssl|donate-level|minerd|xmr-stak|monero'
OR Exe =~ '/tmp/|/private/tmp/|/Users/Shared/'
-- Enumerate persistence plists with non-standard signing paths or recent creation
SELECT FullPath, Mtime, Size,
read_file(filename=FullPath, length=4096) AS PlistHead
FROM glob(globs=['/Library/LaunchDaemons/*.plist',
'/Library/LaunchAgents/*.plist',
'/Users/*/Library/LaunchAgents/*.plist'])
WHERE Mtime > (now() - 1209600) -- created/modified in last 14 days
OR FullPath =~ 'com\.apple\.' AND PlistHead =~ '/tmp/|/Users/Shared/|curl|base64'
Remediation and Verification Script
Run the following on macOS endpoints (via MDM, Jamf, or your RMM) to verify the Screen Sharing state, kill suspicious listeners and miner processes, and audit recent persistence.
#!/bin/bash
# macOS Screen Sharing exploitation — verify, disable, and audit
set -euo pipefail
echo "=== [1] macOS version (confirm against latest Apple security release) ==="
sw_vers
echo "=== [2] Screen Sharing / Remote Management status ==="
sudo launchctl list 2>/dev/null | grep -i -E 'screensharing|ARD|vnc' || echo "No screensharingd/ARD services loaded"
echo "=== [3] Disable Screen Sharing and Remote Management ==="
sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.screensharing.plist 2>/dev/null || echo "Screen Sharing daemon not loaded"
sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -stop 2>/dev/null || echo "Remote Management not active"
echo "=== [4] Verify nothing is listening on TCP 5900 ==="
sudo lsof -nP -iTCP:5900 -sTCP:LISTEN || echo "OK — no listener on 5900"
echo "=== [5] Hunt for miner processes ==="
ps aux | grep -i -E 'xmrig|minerd|xmr-stak|cpuminer|stratum' | grep -v grep || echo "OK — no miner processes found"
echo "=== [6] Audit persistence created/modified in the last 14 days ==="
for dir in /Library/LaunchDaemons /Library/LaunchAgents /Users/*/Library/LaunchAgents; do
[ -d "$dir" ] && find "$dir" -name '*.plist' -mtime -14 -exec ls -la {} \; 2>/dev/null
done
echo "=== [7] Suspicious executables in temp/shared locations ==="
find /tmp /private/tmp /Users/Shared -type f -perm +111 -mtime -14 2>/dev/null | head -50 || true
echo "=== [8] Application Firewall status (should be enabled with stealth mode) ==="
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
/usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode
Remediation
- Patch immediately. Apply the current macOS security update from Apple that addresses the Screen Sharing authentication bypass. Verify build numbers against Apple's security releases page: https://support.apple.com/en-us/100100 — do not assume auto-update has run on every endpoint; audit fleet version compliance via your MDM.
- Disable Screen Sharing and Remote Management unless operationally required. This is the definitive mitigation. If remote access is required, move it behind an authenticated jump host, MDM-native remote control, or VPN — never expose VNC/RFB (TCP/5900) directly.
- Enforce the Application Firewall. Enable with stealth mode and block all incoming connections by default:
socketfilterfw --setglobalstate on --setstealthmode on. Firewall rules blocking inbound 5900 from untrusted networks are a compensating control, not a substitute for patching. - Audit for compromise before assuming cleanliness. Patching closes the door; it does not evict anyone already inside. Run the detection content above, review launchd persistence, and check for outbound connections to mining pools (stratum protocol, commonly TCP 3333/5555/7777/14444). Any confirmed miner is an IR event, not a cleanup ticket — treat it as an intrusion with unknown additional activity.
- Network-level controls. Block outbound stratum mining traffic at the proxy/firewall where feasible, and alert on any endpoint initiating long-lived high-entropy TCP sessions to unknown hosts on mining-common ports.
- Inventory your macOS attack surface. Most organizations have poor visibility into which Macs have sharing services enabled. Use MDM queries to enumerate Screen Sharing, Remote Login (SSH), and Remote Management state fleet-wide — and alert on any change.
The NCSC advisory and Apple's security release notes should be monitored for follow-on details, including a formal CVE assignment and any CISA KEV listing, which would trigger federal remediation timelines. Assume scanning for exposed TCP/5900 is already industrialized; act accordingly.
Related Resources
Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.