macOS Screen Sharing Vulnerability Exploited in the Wild: Root Access and Monero Cryptominer Detection & Remediation Guide

---
title: macOS Screen Sharing Daemon Spawning Shell or Script Interpreter
id: 3f8a2c41-7b9d-4e6f-a1c2-5d8e9f0a1b2c
status: experimental
description: Detects screensharingd or ARDAgent spawning shells or script interpreters, consistent with post-exploitation activity following exploitation of the macOS Screen Sharing service reported in August 2026.
references:
  - https://www.malwarebytes.com/blog/bugs/2026/08/update-your-mac-screen-sharing-vulnerability-exploited-in-the-wild
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.execution
  - attack.t1059
  - attack.initial_access
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    ParentImage|endswith:
      - '/screensharingd'
      - '/ARDAgent'
      - '/ScreensharingAgent'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/osascript'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate remote administration tooling invoked via Apple Remote Desktop (rare for interactive shells; investigate context)
level: high
---
title: macOS LaunchDaemon Persistence Created by Shell or Downloader
id: 9c1d4e72-3a6b-4f58-b2d1-7e0a3c5f8d9e
status: experimental
description: Detects creation of LaunchDaemon/LaunchAgent plist files by shells, curl, or other download utilities, matching the persistence behavior of cryptominers deployed after the macOS Screen Sharing exploitation campaign.
references:
  - https://www.malwarebytes.com/blog/bugs/2026/08/update-your-mac-screen-sharing-vulnerability-exploited-in-the-wild
  - https://attack.mitre.org/techniques/T1543/001/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1543.001
logsource:
  category: file_event
  product: macos
detection:
  selection_path:
    TargetFilename|contains:
      - '/Library/LaunchDaemons/'
      - '/Library/LaunchAgents/'
      - '/LaunchAgents/'
  selection_ext:
    TargetFilename|endswith: '.plist'
  selection_process:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/osascript'
  condition: selection_path and selection_ext and selection_process
falsepositives:
  - Software installers and MDM agents writing plists (typically signed installer/pkg processes, not interactive shells or curl)
level: high
---
title: macOS Cryptominer Execution and Stratum Pool Indicators
id: 6b2e7a15-8c4d-4f19-a3e5-2b9d1e6f0c7a
status: experimental
description: Detects execution of known Monero miner binaries and command-line indicators of Stratum mining protocol usage, matching the cryptomining payload reported in the macOS Screen Sharing exploitation campaign.
references:
  - https://www.malwarebytes.com/blog/bugs/2026/08/update-your-mac-screen-sharing-vulnerability-exploited-in-the-wild
  - https://attack.mitre.org/techniques/T1496/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.impact
  - attack.t1496
logsource:
  category: process_creation
  product: macos
detection:
  selection_img:
    Image|contains:
      - 'xmrig'
      - 'xmr-stak'
      - 'minerd'
      - 'cpuminer'
  selection_cli:
    CommandLine|contains:
      - 'stratum+tcp://'
      - 'stratum+ssl://'
      - '--coin=monero'
      - '--algo=rx/'
      - '--donate-level'
      - 'xmrpool'
      - 'nanopool'
      - 'supportxmr'
      - 'hashrate'
  condition: 1 of selection_*
falsepositives:
  - Legitimate mining activity (rare in enterprise environments; should be policy-prohibited regardless)
level: critical

// Hunt: macOS Screen Sharing post-exploitation & cryptominer activity
let TimeWindow = 14d;
let SuspiciousParents = dynamic(["screensharingd", "ARDAgent", "ScreensharingAgent"]);
let ShellsAndDownloaders = dynamic(["sh", "bash", "zsh", "curl", "wget", "python", "python3", "osascript"]);
let MinerIndicators = dynamic(["xmrig", "xmr-stak", "minerd", "cpuminer", "stratum+tcp", "stratum+ssl", "--donate-level", "--algo=rx/", "supportxmr", "xmrpool", "nanopool"]);
// Stage 1: Screen Sharing / ARD daemons spawning shells or downloaders
let Stage1 = DeviceProcessEvents
| where TimeGenerated > ago(TimeWindow)
| where InitiatingProcessFileName in~ (SuspiciousParents)
| where FileName in~ (ShellsAndDownloaders)
| project Stage1Time=TimeGenerated, DeviceName, DeviceId, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName;
// Stage 2: Miner execution or Stratum CLI indicators
let Stage2 = DeviceProcessEvents
| where TimeGenerated > ago(TimeWindow)
| where ProcessCommandLine has_any (MinerIndicators) or FileName has_any (MinerIndicators)
| project Stage2Time=TimeGenerated, DeviceName, DeviceId, FileName, ProcessCommandLine, SHA256, AccountName;
// Stage 3: Launchd persistence written by shells/downloaders
let Stage3 = DeviceFileEvents
| where TimeGenerated > ago(TimeWindow)
| where FolderPath has_any ("/Library/LaunchDaemons/", "/Library/LaunchAgents/") and FolderPath endswith ".plist"
| where InitiatingProcessFileName in~ (ShellsAndDownloaders)
| project Stage3Time=TimeGenerated, DeviceName, DeviceId, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine;
Stage1
| union Stage2
| union Stage3
| sort by DeviceName, coalesce(Stage1Time, coalesce(Stage2Time, Stage3Time))

// Network hunt: macOS endpoints connecting to common mining pool ports
let MiningPorts = dynamic([3333, 4444, 5555, 7777, 8888, 14444, 45700]);
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemotePort in (MiningPorts)
| where InitiatingProcessFileName !in~ (dynamic(["firefox", "Google Chrome", "Safari", "Microsoft Edge"]))
| summarize Connections=count(), RemoteIPs=make_set(RemoteIP), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
  by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemotePort
| order by Connections desc

-- macOS Screen Sharing Exploitation / Cryptominer Triage
-- Combines process, persistence, and network artifacts in one hunt

-- 1. Processes: miners, shells spawned near remote-access daemons, Stratum CLI flags
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime,
       'process' AS ArtifactType
FROM pslist()
WHERE CommandLine =~ '(?i)(xmrig|xmr-stak|minerd|stratum\+tcp|stratum\+ssl|donate-level|algo=rx/|supportxmr|xmrpool|nanopool)'
   OR Name =~ '(?i)(xmrig|minerd|cpuminer)'

UNION ALL

-- 2. LaunchDaemon/LaunchAgent plists modified in the last 14 days
SELECT 0 AS Pid, 0 AS Ppid, OSPath AS Name, '' AS CommandLine,
       OSPath AS Exe, '' AS Username, Mtime AS CreateTime,
       'persistence_plist' AS ArtifactType
FROM glob(globs=['/Library/LaunchDaemons/*.plist',
                 '/Library/LaunchAgents/*.plist',
                 '/Users/*/Library/LaunchAgents/*.plist'],
          accessor='file')
WHERE Mtime > (now() - 14 * 24 * 3600)

UNION ALL

-- 3. Established connections to common mining pool ports
SELECT Pid, 0 AS Ppid, Name, '' AS CommandLine,
       Raddr AS Exe, '' AS Username, now() AS CreateTime,
       'network_stratum' AS ArtifactType
FROM netstat()
WHERE Status =~ 'ESTABLISHED'
  AND Raddr =~ ':(3333|4444|5555|7777|8888|14444|45700)$'

#!/bin/bash
# macOS Screen Sharing Exploitation — Audit & Harden Script
# Run with sudo on each endpoint or deploy via MDM (Jamf, Kandji, Intune)

echo "=== [1] Current macOS build ==="
sw_vers

echo ""
echo "=== [2] Pending security updates (install all) ==="
softwareupdate -l 2>&1
# Uncomment to apply updates automatically:
# softwareupdate -i -a --restart

echo ""
echo "=== [3] Is anything listening on VNC port 5900? ==="
lsof -nP -iTCP:5900 -sTCP:LISTEN || echo "No listener on 5900"

echo ""
echo "=== [4] Screen Sharing / Remote Management status ==="
sudo launchctl list 2>/dev/null | grep -iE 'screenshar|ARD|RemoteDesktop' || echo "No Screen Sharing/ARD daemons loaded"
ls /Library/Application\ Support/Apple/Remote\ Desktop/ 2>/dev/null || echo "No ARD config directory"

echo ""
echo "=== [5] Disable Screen Sharing if not required ==="
# Disables Screen Sharing and Remote Management (requires root)
sudo launchctl disable system/com.apple.screensharing 2>/dev/null && echo "screensharing disabled in launchd"
sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -stop 2>/dev/null && echo "Remote Management deactivated"

echo ""
echo "=== [6] Block VNC at the Application Firewall (defense in depth) ==="
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setblockall on 2>/dev/null || \
  echo "NOTE: --setblockall blocks all inbound; tune per your environment before enforcing"

echo ""
echo "=== [7] Check for miner persistence artifacts ==="
find /Library/LaunchDaemons /Library/LaunchAgents ~/Library/LaunchAgents \
  -name '*.plist' -mtime -14 -exec ls -la {} \; 2>/dev/null

echo ""
echo "=== [8] Check for known miner binaries and Stratum processes ==="
ps aux | grep -iE 'xmrig|xmr-stak|minerd|stratum' | grep -v grep || echo "No obvious miner processes"
pgrep -fl xmrig || true

echo ""
echo "=== [9] Flag unsigned plists loading unsigned binaries ==="
for plist in $(find /Library/LaunchDaemons /Library/LaunchAgents -name '*.plist' 2>/dev/null); do
  prog=$(/usr/libexec/PlistBuddy -c 'Print :Program' "$plist" 2>/dev/null) || \
  prog=$(/usr/libexec/PlistBuddy -c 'Print :ProgramArguments:0' "$plist" 2>/dev/null)
  [ -n "$prog" ] && [ -f "$prog" ] && \
    codesign -v "$prog" 2>/dev/null || echo "REVIEW: $plist -> $prog (unsigned or missing)"
done

echo ""
echo "=== Audit complete. Review all REVIEW flags and unexpected listeners. ==="