Signal
MacOS screen sharing vulnerability exploited alongside new browser hijacking malware
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-08-17 08:47 UTCUpdated 2026-08-17 11:35 UTC
rss
cveexploitsmalwareincident_response
Trend in the last 24h
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (3 domains)domains are deduped. counts indicate coverage, not truth.3 top sources shown
Overview
A critical authentication bypass vulnerability in macOS Screen Sharing (CVE-2026-65400) has been actively exploited to gain root access and deploy Monero cryptominers. Apple patched this flaw on August 6 for multiple macOS versions, including Tahoe, Sequoia, and Sonoma.
Score total
1.17
Momentum 24h
3
Posts
3
Origins
3
Source types
1
Duplicate ratio
0%
Why now
- Apple released patches on August 6, but active exploitation has been reported since then.
- AmnesiaStealer's recent discovery shows attackers continue evolving social engineering tactics against macOS users.
- Users with exposed Screen Sharing ports and those tricked by fake GitHub pages are at immediate risk.
Why it matters
- The macOS Screen Sharing vulnerability allows attackers to bypass authentication and gain root access, risking full system compromise.
- AmnesiaStealer malware enables attackers to covertly control victim browsers, increasing risk of credential theft and data loss.
- Prompt patching and cautious user behavior can mitigate these active and evolving threats targeting macOS.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: medium
Recurring claims
- The macOS Screen Sharing vulnerability allows attackers to bypass authentication and gain root access, risking full system compromise.
- AmnesiaStealer malware enables attackers to covertly control victim browsers, increasing risk of credential theft and data loss.
How sources frame it
- Malwarebytes And SecurityWeek Reporting: neutral
- CSO Online Reporting: neutral
Consolidated multiple reports on macOS vulnerabilities and malware into a clear, concise briefing highlighting active exploitation and new threats.
All evidence
All evidence
New macOS malware turns stolen browsers into attacker-controlled sessions
CSO Online · csoonline.com · 2026-08-17 11:35 UTC
Update your Mac: Screen Sharing vulnerability exploited in the wild
Malwarebytes Threat Analysis · malwarebytes.com · 2026-08-17 10:56 UTC
Recent macOS Screen Sharing Vulnerability Exploited in Attacks
SecurityWeek · securityweek.com · 2026-08-17 08:47 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 3Origin domains: 3Duplicates: -
Showing 3 / 0
Top publishers (this list)
- CSO Online (1)
- Malwarebytes Threat Analysis (1)
- SecurityWeek (1)
Top origin domains (this list)
- csoonline.com (1)
- malwarebytes.com (1)
- securityweek.com (1)