Cyber Threat Brief — Issue #016

A vulnerability in the macOS Screen Sharing feature, tracked as CVE-2026-65400, is being actively exploited to gain root access to Macs and install Monero cryptocurrency miners. The flaw lets an attacker on the network authenticate to a Mac's built-in remote desktop service without valid credentials. Apple patched it in an emergency August 6 update, but the situation escalated over the following two weeks. The Dutch national cyber security centre confirmed on August 12 that active exploitation had begun, fueled by a public proof-of-concept exploit. Then on August 14, CISA raised the vulnerability's severity score from 7.1 to a critical 9.8, replacing its original assessment with one that requires no privileges and grants full system compromise, and reclassified the attack as automatable, consistent with unattended Macs being rooted at scale for coin mining. Technical details were presented at the Black Hat conference the week prior. What makes this flaw especially dangerous is that conventional hardening does not help. Removing approved Screen Sharing users, disabling legacy VNC password access, and rotating the VNC password all operate downstream of the broken authentication path, so the attacker never reaches those controls. The only fix is the patch. A Mac that was exposed before patching should be treated as fully compromised.

A critical vulnerability in MLflow, an open-source platform widely used by data science and machine learning teams to track experiments and manage models, is being actively exploited within hours of its disclosure. Tracked as CVE-2026-64849 with a CVSS score of 9.3, the flaw is an unauthenticated server-side request forgery vulnerability that affects all MLflow versions before 3.15.0. Server-side request forgery lets an attacker trick a server into making requests on their behalf. In cloud environments this is especially dangerous, because the attacker can direct the MLflow server to reach internal-only cloud metadata services and extract the credentials and secrets that the server's cloud identity has access to. Security firm watchTowr reported that its honeypot network detected attackers scanning for and targeting exposed MLflow instances within hours of the CVE being assigned on August 17, harvesting cloud credentials and deployment tokens. The flaw exists in MLflow's webhook testing functionality, which a default tracking server exposes without authentication. An earlier partial fix could be bypassed using an HTTP redirect, which the server followed without re-validating the destination. This is a direct example of AI and machine learning infrastructure becoming a primary target, as the systems that hold the keys to cloud environments become the fastest path to those environments.

Two malware campaigns this week reinforce that social engineering and supply chain attacks remain the most reliable ways into an organization. The first, AmnesiaStealer, targets macOS users through fake GitHub pages and ClickFix attacks that trick victims into running malicious Terminal commands. Beyond stealing passwords, browser data, and cryptocurrency wallet information, it also collects Apple Notes, documents, Safari cookies, and keychain credentials. The second, tracked as StubMaker, is a campaign of malicious RubyGems packages that harvest browser credentials, cryptocurrency wallets, seed phrases, and Telegram data. The packages are clumsy typosquats of popular Ruby dependencies, relying on developers mistyping a package name during installation. Both campaigns share the same underlying logic seen throughout 2026: rather than breaking through technical defenses, attackers get the victim to run the malicious code themselves, whether by pasting a command from a fake verification page or by installing a package that looks almost identical to a legitimate one.