Security researchers have confirmed that a recently disclosed vulnerability in macOS Screen Sharing is being actively exploited in the wild. Threat actors are leveraging the flaw to escalate to root access on vulnerable Macs and deploy a Monero (XMR) cryptomining payload — a classic post-exploitation monetization pattern that turns compromised endpoints into revenue-generating assets for the attacker.
This is not a theoretical risk. Confirmed in-the-wild exploitation means any organization with macOS endpoints — developer workstations, creative teams, executive laptops, CI/CD build runners — needs to treat this as an active remediation priority. Cryptominers are often dismissed as low-severity nuisances; that is a mistake. An attacker with root on your macOS fleet has already demonstrated full code execution at the highest privilege level. The miner is simply what they chose to deploy first. Persistence mechanisms, credential theft, and lateral movement tooling are frequently staged alongside or after the mining payload.
Technical Analysis
Affected Component
The vulnerability resides in the macOS Screen Sharing service — Apple's VNC-based remote desktop functionality, governed by the screensharingd daemon and the Remote Management/Screen Sharing preference pane (System Settings → General → Sharing). The service listens on TCP port 5900 when enabled.
Attack Chain (Defender's View)
Based on the reported campaign, the intrusion sequence follows this pattern:
- Initial access / exploitation — The attacker targets the Screen Sharing vulnerability on an exposed or reachable macOS host. Any Mac with Screen Sharing or Remote Management enabled and network-reachable (directly, via VPN, or through compromised internal infrastructure) is a candidate target.
- Privilege escalation to root — Successful exploitation yields root-level code execution on the host. This is the critical inflection point: the attacker now controls the endpoint entirely, including the ability to disable or evade built-in macOS protections (Gatekeeper, XProtect, TCC prompts).
- Payload deployment — A Monero miner (consistent with XMRig-family tooling commonly seen in macOS cryptomining campaigns) is installed and executed.
- Persistence — Miners of this class are almost universally persisted via LaunchDaemons (
/Library/LaunchDaemons/) or LaunchAgents (/Library/LaunchAgents/,~/Library/LaunchAgents/) property lists, ensuring the payload survives reboot. - C2 / pool communication — The miner establishes outbound connections to mining pools or proxy infrastructure, typically over TCP ports 3333, 4444, 5555, 7777, or 443 (to blend with HTTPS).
Exploitation Status
- Active, confirmed in-the-wild exploitation. This campaign is ongoing per the SecurityWeek reporting.
- No CVE identifier was published in the source reporting at time of writing. Defenders should monitor Apple's security releases page and vendor advisories for the assigned identifier and patch specifics — and should not wait for one to begin hardening.
Why Cryptomining Should Trigger Full IR, Not a Cleanup Ticket
From an incident response standpoint, root-level compromise followed by miner deployment has three implications:
- The miner is proof of access, not the extent of it. Treat every affected host as fully compromised. Credentials in the keychain, SSH keys in
~/.ssh/, browser session tokens, and MDM enrollment trust should all be considered exposed. - Resource exhaustion is a detection gift. A miner consuming 90%+ CPU on an idle workstation is one of the noisiest payloads an attacker can deploy — use it.
- Shared infrastructure. Cryptomining campaigns frequently reuse pool wallets, dropper URLs, and persistence naming conventions across victims, making indicator pivots highly effective.
Detection & Response
SIGMA Rules
YAML
---
title: Monero Miner Process Execution on macOS
id: 3f8c1a92-7e4d-4b6a-9c21-5d0e8f2a1b34
status: experimental
description: Detects execution of known Monero mining binaries or miner-typical command-line arguments on macOS endpoints, consistent with the post-exploitation payload observed in the Screen Sharing exploitation campaign.
references:
- https://www.securityweek.com/recent-macos-screen-sharing-vulnerability-exploited-in-attacks/
- https://attack.mitre.org/techniques/T1496/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.impact
- attack.t1496
logsource:
category: process_creation
product: macos
detection:
selection_binary:
Image|contains:
- 'xmrig'
- 'minerd'
- 'cpuminer'
- 'xmr-stak'
selection_args:
CommandLine|contains:
- '--donate-level'
- 'stratum+tcp://'
- 'stratum+ssl://'
- '--coin=monero'
- 'xmr.pool'
- 'supportxmr.com'
- 'minexmr.com'
condition: selection_binary or selection_args
falsepositives:
- Legitimate mining activity authorized by the organization (rare in enterprise environments)
level: high
---
title: Suspicious LaunchDaemon Persistence for Mining Payload on macOS
id: 9b2e4d71-3c8f-4a15-b762-8e1d6c4f5a90
status: experimental
description: Detects creation of LaunchDaemon or LaunchAgent plist files by non-system processes, a common persistence mechanism for cryptomining payloads deployed after root compromise on macOS.
references:
- https://www.securityweek.com/recent-macos-screen-sharing-vulnerability-exploited-in-attacks/
- https://attack.mitre.org/techniques/T1543/001/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.persistence
- attack.privilege_escalation
- attack.t1543.001
logsource:
category: file_event
product: macos
detection:
selection_path:
TargetFilename|contains:
- '/Library/LaunchDaemons/'
- '/Library/LaunchAgents/'
selection_ext:
TargetFilename|endswith: '.plist'
filter_known_updaters:
Image|contains:
- '/System/Library/'
- 'softwareupdated'
- 'Installer'
- '/Library/Apple/'
condition: selection_path and selection_ext and not filter_known_updaters
falsepositives:
- Legitimate enterprise software installation (MDM-deployed agents, EDR tooling) — tune against your software inventory
level: medium
---
title: Screensharingd Spawning Shell or Downloader Processes
id: 5c7a3f18-2d96-4e84-a351-7b9c0e2d4f68
status: experimental
description: Detects the macOS Screen Sharing daemon spawning shells, interpreters, or download utilities — highly anomalous behavior consistent with post-exploitation activity following compromise of the Screen Sharing service.
references:
- https://www.securityweek.com/recent-macos-screen-sharing-vulnerability-exploited-in-attacks/
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.execution
- attack.t1059
- attack.initial_access
- attack.t1021
logsource:
category: process_creation
product: macos
detection:
selection_parent:
ParentImage|contains: 'screensharingd'
selection_child:
Image|endswith:
- '/bash'
- '/sh'
- '/zsh'
- '/python'
- '/python3'
- '/curl'
- '/wget'
- '/osascript'
- '/perl'
condition: selection_parent and selection_child
falsepositives:
- Rare; screensharingd does not legitimately spawn interactive shells or downloaders in normal operation
level: critical
KQL — Microsoft Sentinel / Defender
The following query hunts macOS endpoints (via Defender for Endpoint on Mac or Syslog ingestion) for miner execution, suspicious persistence, and Screen Sharing process anomalies:
KQL — Microsoft Sentinel / Defender
// Hunt: macOS cryptominer execution, persistence, and screensharingd anomalies
let MinerTerms = dynamic(["xmrig", "minerd", "cpuminer", "xmr-stak", "stratum+tcp", "stratum+ssl", "supportxmr", "minexmr", "--donate-level"]);
let PersistencePaths = dynamic(["/Library/LaunchDaemons/", "/Library/LaunchAgents/"]);
union isfuzzy=true
(DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName has_any (MinerTerms) or ProcessCommandLine has_any (MinerTerms)
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, FolderPath, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionSource="ProcessEvents"),
(DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "screensharingd"
| where FileName in~ ("bash", "sh", "zsh", "python", "python3", "curl", "wget", "osascript", "perl")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, FolderPath, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionSource="ScreensharingdChildProc"),
(DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any (PersistencePaths) and FileName endswith ".plist"
| where InitiatingProcessFolderPath !has "/System/Library/" and InitiatingProcessFileName !in~ ("softwareupdated", "installer")
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionSource="LaunchPersistence"),
(DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemotePort in (3333, 4444, 5555, 7777, 14444)
| where InitiatingProcessFileName !in~ ("sshd", "mDNSResponder")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl, DetectionSource="MiningPoolPorts")
| order by TimeGenerated desc
Velociraptor VQL
VQL — Velociraptor
-- Hunt macOS fleet: miner processes, LaunchDaemon persistence, and pool connections
LET procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(xmrig|minerd|cpuminer|xmr-stak|stratum\+(tcp|ssl)|donate-level)'
OR Name =~ '(xmrig|minerd|cpuminer)'
LET persistence = SELECT FullPath, Mtime, Size,
read_file(filename=FullPath, length=4096) AS PlistHead
FROM glob(globs=['/Library/LaunchDaemons/*.plist', '/Library/LaunchAgents/*.plist'])
WHERE Mtime > now() - 604800
AND read_file(filename=FullPath, length=4096) =~ '(curl|/tmp/|/var/tmp/|xmrig|stratum|base64)'
LET conns = SELECT Pid, Name, RemoteAddr, RemotePort, State
FROM netstat()
WHERE RemotePort IN (3333, 4444, 5555, 7777, 14444)
AND State =~ 'ESTABLISHED'
SELECT 'process' AS Artifact, Pid, Name, CommandLine, Username, CreateTime AS Observed, NULL AS FullPath, NULL AS Remote
FROM procs
UNION ALL
SELECT 'persistence' AS Artifact, NULL AS Pid, NULL AS Name, NULL AS CommandLine, NULL AS Username, Mtime AS Observed, FullPath, NULL AS Remote
FROM persistence
UNION ALL
SELECT 'network' AS Artifact, Pid, Name, NULL AS CommandLine, NULL AS Username, now() AS Observed, NULL AS FullPath, RemoteAddr + ':' + format(format='%d', args=RemotePort) AS Remote
FROM conns
Remediation & Verification Script (Bash — macOS)
Bash / Shell
#!/bin/bash
# macOS Screen Sharing exploitation — verify, remediate, and harden
# Run with sudo on suspected or potentially exposed hosts
echo "=== [1] Check Screen Sharing / Remote Management status ==="
# ARD agent plist indicates Remote Management/Screen Sharing state
if pgrep -x screensharingd >/dev/null 2>&1; then
echo "[!] screensharingd is RUNNING on port 5900 — service is exposed"
lsof -iTCP:5900 -sTCP:LISTEN
else
echo "[OK] screensharingd not running"
fi
echo ""
echo "=== [2] Disable Screen Sharing and Remote Management ==="
# Requires root; kickstart is Apple's supported ARD/Remote Management control tool
/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -stop 2>/dev/null
launchctl unload -w /System/Library/LaunchDaemons/com.apple.screensharing.plist 2>/dev/null
echo "[OK] Screen Sharing services stopped/disabled (re-enable only via MDM policy if business-required)"
echo ""
echo "=== [3] Check for pending macOS security updates ==="
softwareupdate --list 2>/dev/null | grep -i -E "macOS|Security" || echo "[OK] No pending updates reported"
echo ""
echo "=== [4] Hunt for miner processes ==="
ps aux | grep -iE "xmrig|minerd|cpuminer|xmr-stak|stratum" | grep -v grep || echo "[OK] No known miner processes found"
echo ""
echo "=== [5] Audit recent LaunchDaemon/LaunchAgent persistence (last 14 days) ==="
find /Library/LaunchDaemons /Library/LaunchAgents ~/Library/LaunchAgents -name "*.plist" -mtime -14 -exec ls -la {} \; 2>/dev/null
echo ""
echo "=== [6] Check for established connections on common mining pool ports ==="
lsof -iTCP -sTCP:ESTABLISHED -nP | grep -E ":(3333|4444|5555|7777|14444)" || echo "[OK] No suspicious pool connections"
echo ""
echo "=== [7] Verify XProtect and Gatekeeper are enabled ==="
spctl --status
defaults read /Library/Preferences/com.apple.Xprotect.plist 2>/dev/null | head -5 || true
echo ""
echo "=== [8] Block Screen Sharing at the Application Firewall ==="
/usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
/usr/libexec/ApplicationFirewall/socketfilterfw --setblockall on 2>/dev/null
echo "[!] NOTE: --setblockall blocks ALL inbound services; comment out if file sharing/MDM requires exceptions"
echo ""
echo "Done. If any miner artifacts were found: isolate the host, preserve /var/log, capture keychain/SSH key exposure scope, and initiate full IR."
Remediation
- Patch immediately. Apply the latest macOS security update from Apple as soon as it is available for your fleet. Monitor Apple Security Releases for the advisory covering the Screen Sharing fix and the assigned CVE identifier. Enforce update compliance through your MDM (Jamf, Kandji, Intune) with a defined deadline — for actively exploited vulnerabilities, 72 hours is a reasonable internal SLA; treat it like a CISA KEV deadline even before formal listing.
- Disable Screen Sharing and Remote Management where not business-required. This is the single highest-value compensating control. Audit your fleet for hosts listening on TCP 5900 and disable the service via MDM configuration profile rather than relying on user settings.
- Restrict network reachability. Where Screen Sharing must remain enabled, restrict port 5900 to specific management subnets via the macOS Application Firewall or network-layer controls. Screen Sharing should never be reachable from the internet or broad internal segments.
- Hunt before you patch. Patching closes the door but does not evict anyone already inside. Run the KQL/VQL hunts above across the fleet — particularly for LaunchDaemon persistence and pool-port egress — before declaring hosts clean.
- Treat miner-positive hosts as fully compromised. Root access means keychain contents, SSH private keys, browser sessions, and MDM trust are all in scope. Rotate credentials, reissue certificates, and consider re-imaging rather than cleaning.
- Egress filtering. Block outbound connections to known mining pool ports and domains at the perimeter. Miners are useless without pool connectivity, and blocked egress generates a high-fidelity detection signal.
- Verify endpoint protection coverage on macOS. macOS fleets are chronically under-instrumented. Confirm your EDR is deployed, tamper-protected, and actually forwarding process-creation telemetry for Mac endpoints — you cannot hunt what you cannot see.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.