Hackers have been exploiting an authentication vulnerability in macOS Screen Sharing to gain root access to victims' machines and install Monero mining software, according to the Netherlands' national cyber security agency, as reported by The Block and Decrypt.

According to Decrypt, the flaw allows attackers to bypass authentication controls in Screen Sharing, macOS’s built-in remote access tool, giving them root-level privileges once inside. From there, attackers plant miners that generate Monero, the privacy-focused cryptocurrency often favored in cryptojacking campaigns because its transactions are harder to trace.

The Block reports that U.S. officials have assigned the vulnerability a severity score of 9.8 out of 10 on the Common Vulnerability Scoring System (CVSS), a rating that classifies it as critical. Decrypt notes that proof-of-concept exploit code for the flaw is now publicly available, which security researchers say increases the likelihood of wider exploitation as more attackers gain access to working code.

Both outlets report that experts are urging Mac users to update their devices to patch the vulnerability. Cryptojacking attacks like this one typically run in the background without a victim’s knowledge, consuming device resources to mine cryptocurrency for the attacker rather than stealing funds directly from a wallet.

Sources: The Block, Decrypt

This article is for information only and is not financial advice.