A newly disclosed campaign is targeting Apple computers, with attackers exploiting a flaw in the macOS Screen Sharing feature to seize control of machines and quietly turn them into cryptocurrency mining rigs, according to warnings from Dutch cybersecurity authorities.
How the Attack Works
The Dutch national cyber agency reported that hackers are abusing an authentication weakness in macOS Screen Sharing, the built-in tool that lets users remotely view and control another Mac. By circumventing the normal login safeguards, attackers can obtain root access — the highest level of administrative control on the operating system.
Once inside, the intruders install software designed to mine Monero, a privacy-focused cryptocurrency prized by cybercriminals because its transactions are difficult to trace. The mining process runs in the background, siphoning off computing power and electricity while the legitimate owner remains unaware.
Attackers slip past macOS login safeguards, seize root control, and quietly hijack the machine to mine untraceable crypto.
Why the Threat Is Escalating
The situation has grown more urgent because proof-of-concept code demonstrating the exploit is now publicly available. When such code circulates openly, it dramatically lowers the barrier for less sophisticated attackers to launch their own attacks, potentially widening the pool of victims.
Monero has long been a favorite among illicit miners. Its built-in privacy features obscure the sender, receiver, and amount of each transaction, making it a natural choice for anyone looking to profit from stolen computing resources without leaving an easy trail.
Security experts typically recommend a handful of defensive measures for users worried about this class of threat:
- Disable Screen Sharing when it is not actively needed
- Keep macOS updated with the latest security patches
- Watch for unusual spikes in CPU usage or system slowdowns
Users who notice their Mac running hot, draining battery quickly, or lagging without explanation may want to investigate, as those symptoms can signal an unauthorized miner quietly at work.