Alarming Zero-Day Mac Attack Gives Hackers Full System Control, Active Exploit

The National Cyber Security Centrum (NCSC) of the Netherlands says it has evidence that hackers are actively exploiting a vulnerability in one of macOS’ sharing features, which can provide attackers with complete access over a victim’s computer. This flaw was discovered across several macOS releases, including Tahoe, Sequoia and Sonoma.

The vulnerability stems from the authentication process failing due to “insufficient state management,” where macOS fails to properly track or enforce the correct sequence of steps in a login or connection process. This gives network attackers access to a system without valid login credentials. Not only does this provide access to a system, but it also enables attackers to complete additional actions a system wouldn’t normally allow without having to input the necessary credentials.

The Netherlands cybersecurity organization shared that it has been notified that “active abuse of this vulnerability has been observed on multiple systems on which port 5900 was accessible from the Internet.” This port is used by macOS for its screen sharing feature, which automatically opens the port in the OS firewall when a user enables it.


Once attackers have managed to a compromise a system using this vulnerability, they have been able to gain root access, which has been then used to install a Monero crypto miner. Although now that malicious actors know that this vulnerability exists, it’s only a matter of time until more sophisticated attacks begin to surface, because with root access a hacker can go well beyond just installing a simple crypto miner.

Thankfully, Apple has already released a patch to fix this flaw, so users should make sure they’re running the most up-to-date version of their OS. However, after the discovery of this flaw, it’s better for users to only keep screen sharing enabled when they need to use it and disable it when it’s not needed. To do that, go to “Settings,” click on “General,” choose “Sharing” and set the “Screen Sharing” toggle to off.