A macOS Screen Sharing vulnerability that Apple rushed to patch earlier this month is now being actively exploited in the wild, according to the Netherlands' National Cyber Security Center (NCSC-NL).

On August 6, Apple released macOS Tahoe 26.6.1 to address a critical flaw allowing attackers to authenticate to Screen Sharing without valid credentials, potentially granting full remote control of a Mac's screen, keyboard, and mouse. However, the NCSC-NL has confirmed that hackers have already been abusing this vulnerability, particularly on systems where port 5900 was accessible from the internet.

"In all these cases, root had been accessed on the affected system and a Monero crypto miner had been placed," the NCSC-NL reported. This means compromised Macs were being used to mine cryptocurrency without the user's knowledge.

The fix was also included in macOS Sonoma 14.8.9 and macOS Sequoia 15.7.9, with Apple stating it resolved the authentication issue through improved state management. Users are strongly advised to update their Macs immediately and consider using a VPN when Screen Sharing is active, even after updating.