Cryptojacking on macOS

[_act_]

The hackers exploited an authentication flaw in macOS Screen Sharing to gain root access and plant Monero miners to mine for them on people's devices.

You can read more about it yourself
https://decrypt.co/375749/hackers-macos-screen-sharing-secretly-mine-monero

All what that are needed to avoid malware is not hard, but many people will not learn how to avoid malware until it is too late. Cryptojacking is still better, but if a hacker can infect your device with the malware, definitely such devices are prone to other malware line trojan.

[Dunamisx]

Some people are not aware of what to do when the encounter such experiences that may lead to a serious harm over their assets, tell me about all this but still want to try out their possible ways and be smarter without knowing their other actors that are more smarter than them in the game, you don't take vulnerability for granted when it comes to cryptocurrency and this is where we must always ensure we have the maximum security alertness over anything that would serve a threat.

[pawanjain]

The hackers exploited an authentication flaw in macOS Screen Sharing to gain root access and plant Monero miners to mine for them on people's devices.

You can read more about it yourself
https://decrypt.co/375749/hackers-macos-screen-sharing-secretly-mine-monero

All what that are needed to avoid malware is not hard, but many people will not learn how to avoid malware until it is too late. Cryptojacking is still better, but if a hacker can infect your device with the malware, definitely such devices are prone to other malware line trojan.

I was wondering why would a hacker do that. Mining monero on a web browser is practically dead so it makes no sense.
But then I got to know that it only makes sense when the hacker has compromised a lot of devices, which is quite easy since the internet is vast.
Its kinda smart to have exploited a single port open to the internet via screensharing and then gain root access to the system, quite impressive.
Thanks for posting and making us aware of such attacks.

[asriloni]

It's only affecting those who exposed their screen sharing to internet. Anyone who never does i shall not feel worry. However, apple has patched it in their tahoe 25.6.1 version. So i think it's gonna be a wise decision for any macos users to update their software to the latest update (25.6.2) because i already updated mine. hehe.

[elda34b]

So i think it's gonna be a wise decision for any macos users to update their software to the latest update (25.6.2) because i already updated mine.

Looks like they updated other versions too. I'm still on Sequioa for example, and it's important for me to get this update since I used screen sharing feature quite regularly. I guess if you don't use that feature you don't have to update asap. Still though, maybe other attacks will try to encourage users enable that feature and use the exploit to begin their infection.

[TastyChillySauce00]

If my Mac suddenly got exploited and mine monero, The first thing I would do is factory reset, if the hackers can install monero miners with the exploit, I wonder what other things they can do as well.

I think we've now come to the point where no matter what OS you're using, be it an open source linux, windows, or even MacOS you will need to be extra careful of malwares, even on a curated App Store there is still malware such as CryptoKitty.