Attention, a serious vulnerability has been discovered on Apple macOS devices.

A critical security vulnerability has been discovered in Apple devices running macOS, according to a report from the Netherlands' National Cyber Security Centre (NCSC). The flaw allows remote execution of malicious code, granting attackers elevated system privileges and enabling them to install cryptocurrency mining software such as Monero. The NCSC warned users to apply available updates immediately, as the vulnerability affects macOS versions Tahoe, Sequoia, and Sonoma. The discovery comes amid growing concerns over cybersecurity threats targeting Apple products. While Apple’s market share has steadily increased since the early 2000s, so too has interest among cybercriminals. Once dominated by Windows-based systems, Apple's user base has become a more attractive target as its market presence expands. This shift has led to a rise in malware targeting macOS, challenging the long-held belief that Apple devices are inherently secure against viruses and other forms of malicious software. The vulnerability was identified through a specific weakness within macOS’s screen sharing feature. This function enables remote access to a Mac’s display, allowing users to control the keyboard and mouse from another device. However, researchers found that this functionality could be exploited to grant unauthorized access to the system. Attackers could leverage the flaw to bypass authentication mechanisms and execute arbitrary code remotely. The severity of the issue was rated at 7.1 out of 10, indicating a high risk level rather than a simple programming error. Apple responded swiftly to the report by releasing patches for affected macOS versions, Tahoe, Sequoia, and Sonoma. Users with these operating systems are advised to check for updates to ensure their devices remain protected. The NCSC emphasized that unpatched systems remain vulnerable, particularly when screen sharing is enabled. In such cases, macOS opens network port 5900, which can be exploited by attackers if left unprotected. While many users may not face immediate risks due to firewalls and routers blocking external access to port 5900, experts caution against complacency. Even if the default configuration provides some protection, the potential for exploitation exists. If an attacker gains control of a device via this vulnerability, they could deploy additional malware beyond cryptocurrency miners, including password stealers or other types of malicious software designed to compromise user data. To mitigate the risk, users are encouraged to disable screen sharing unless absolutely necessary. When required, they should consider using a virtual private network (VPN) or SSH tunneling to create a more secure connection. These measures, while effective, may be complex for average users. As a result, many experts recommend keeping screen sharing disabled by default and activating it only when needed. Currently, the primary threat associated with this vulnerability appears to be the deployment of Monero mining software. Users may notice slower performance and higher energy consumption, though the benefits of mining typically accrue to the attackers. Nevertheless, the broader implications of the flaw extend beyond cryptocurrency mining. If attackers gain full control of a device, they could exploit the system for more damaging purposes, highlighting the need for continued vigilance and timely patching.