root@deepquest.code511.com:~# 
[ANDROID]

>> CVE-2026-65400 Mac check

USER: deepquest // DATE: 2026-11-11 01:26 // MODIFIED: 2026-11-11

Detect and clean the macOS Screen Sharing → root → XMRig miner campaign that exploits CVE-2026-65400.

In October 2026 automated scanners logged in to Screen Sharing as root with no password (the CVE-2026-65400 authentication bypass), planted backdoors and tried to install a Monero miner. It is a mass, automated campaign: if your Mac was unpatched and Screen Sharing or Remote Management could be reached from the internet, please check it.

Am I at risk?

You are at risk if all three are true:

  1. macOS is older than Tahoe 26.6.1 / Sequoia 15.7.9 / Sonoma 14.8.9 (where Apple fixed it), and
  2. Screen Sharing or Remote Management is on (System Settings → General → Sharing), and
  3. port 5900 or 3283 is reachable from the internet (router port forward, UPnP, DMZ, or a public IP).
git clone https://github.com/mrraylau321/cve-2026-65400-mac-check.git
cd cve-2026-65400-mac-check
sudo bash detect.sh # read-only: changes nothing
sudo bash detect.sh --keys # read-only: lists every SSH key that can log in to this Mac
sudo bash cleanup.sh # dry run: lists what it would remove
sudo bash cleanup.sh --apply # cleans: moves files to a root-only quarantine folder, deletes nothing
sudo bash detect.sh # check again

source: https://github.com/mrraylau321/cve-2026-65400-mac-check

> POST_COMMENT