Picture your computer quietly working for someone else while you're away from the desk, burning your electricity and dragging down performance, all to generate cryptocurrency that lands in a criminal's wallet. That's not a hypothetical. It's exactly what has been happening by exploiting a critical security flaw in Apple Mac computers, as flagged by cybersecurity authorities in recent days.
NCSC
This type of attack is called cryptojacking, and it's one of the most insidious threats in the crypto world precisely because it operates in silence. This article breaks down what happened, what cryptojacking actually is, why criminals choose a specific cryptocurrency, how to tell whether your device is compromised, and how to protect yourself. The good news: defending against this is both possible and straightforward.
Calif
What Happened: The macOS Vulnerability
The Dutch National Cyber Security Centre (NCSC-NL) reported a serious vulnerability in a macOS feature called Screen Sharing, which allows remote control of a Mac. The flaw received a severity score of 9.8 out of 10, classified as “critical,” because it allows an attacker to gain full remote control of the machine without needing a password. No credentials required.
Once in control, criminals used these compromised Macs for one specific purpose: silently installing software that mines the Monero cryptocurrency, exploiting the victims' processing power and electricity. One important clarification that puts the risk in perspective: Screen Sharing is disabled by default on Macs. The attack primarily targets machines that have it enabled and exposed directly to the internet, typically professional setups on remote servers rather than everyday home computers. Apple has already released a patch.
PoC for a critical vulnerability in Apple macOS Screen Sharing (CVE-2026-65400).
— Calif (@calif_io) August 8, 2026
If Screen Sharing is enabled, any network attacker can exploit the bug to log in as any account, without knowing the password.
We reverse engineered Apple's unusual macOS 26.6.1 patch to understand… pic.twitter.com/WRIIwKx6yI
What Is Cryptojacking?
This is the concept that matters beyond any single incident. Cryptojacking is the unauthorized, covert use of someone else's computer to “mine” cryptocurrency: running the complex calculations that generate new digital coins, a process that demands significant processing power. The criminal doesn't steal money directly from your bank account. Instead, they steal a resource: your CPU cycles and the electricity powering them.
It's a silent, parasitic theft. Victims often notice nothing at first, only a sluggish computer, rising temperatures, fans running at full speed, and an electricity bill that's higher than expected at the end of the month. Unlike ransomware, which encrypts your files and demands payment, cryptojacking aims to stay hidden as long as possible. The longer the mining software runs undisturbed, the more the criminal earns. That's what makes it so insidious: no noise, no dramatic signal, just a machine quietly working against its owner.
Cryptojacking: Warning Signs
How to tell if your device has been compromised. Source: cybersecurity experts, 2026
- Sudden slowdown: the device becomes sluggish and unresponsive even with only a few apps open.
- Heat and fan noise: the computer runs hot and fans spin at maximum speed even when idle.
- Battery and power bill: battery drains unusually fast and electricity consumption rises without any obvious reason.
Why Monero and Not Bitcoin?
It's a fair question: why do cryptojackers mine Monero rather than Bitcoin or any better-known cryptocurrency? The answer reveals a lot about the logic of cybercrime. Two main reasons, both rooted in Monero's technical design.
The first is privacy. Monero was built specifically to make transactions extremely difficult to trace. Bitcoin transactions, by contrast, are recorded publicly on a transparent ledger and are at least partially reconstructable. For a criminal, Monero's opacity is ideal: following the money back to its source becomes nearly impossible. The second reason is technical. Monero is designed to be mined efficiently on ordinary consumer CPUs, including the processors inside a Mac, without requiring the expensive, specialized hardware that Bitcoin mining demands. That combination of privacy and low hardware requirements makes Monero the default choice for cryptojacking operations worldwide.
How to Protect Your Mac
Here's the part that actually matters. Defending against this specific attack and against cryptojacking in general comes down to a handful of practical steps. The single most important action right now is to update your Mac immediately. Apple has already released a patch that closes the vulnerability, and installing the latest available system update resolves the problem at its root.
One technical detail worth knowing: changing the Screen Sharing password does nothing to block this attack, because the flaw operates before the system even checks the password. The only real fix is the update. If you don't use Screen Sharing at all, disabling it entirely removes the attack surface completely.
More broadly, the standard practices against cryptojacking still apply:
- Keep your operating system and all applications up to date.
- Don't install software from untrusted or unofficial sources.
- Be cautious with suspicious email attachments and links.
- Pay attention to the warning signs described above: unexpected slowness, heat, and high fan activity.
If your Mac suddenly runs hot and slow without an obvious cause, check Activity Monitor to see which processes are consuming CPU resources. When in doubt, have the device examined by a professional. In cybersecurity, prevention and awareness consistently outperform reactive fixes.
The Bigger Picture
This incident illuminates a lesser-known but widespread corner of the crypto world. When people think about cryptocurrency and crime, the mind jumps to large exchange hacks or investment fraud. Cryptojacking is different and more subtle, though it doesn't steal existing cryptocurrency. It conscripts victims' machines into producing new coins, turning private computers into profit generators without the owners' knowledge.
For everyday users, the lesson is that cybersecurity and crypto are increasingly intertwined. Protecting your devices is now a form of economic self-defense. Cryptocurrency has created new financial incentives for cybercriminals, and cryptojacking is one of the cleaner expressions of how those incentives translate into attacks on ordinary people. The encouraging part is that protection is within reach for anyone: consistent updates, a degree of caution online, and awareness of how your machine normally behaves. In an era where our devices hold more value than ever, this case is a useful reminder that attention costs nothing and neglect can cost quite a lot.
