Threat video1:00
Apple September 2026 Patches 273 CVEs: Detection & IOCs
Screen Sharing bypass CVE-2026-65400 is exploited for root and XMRig mining; 9 detection rules, 11 IOCs and a free Splunk SPL rule.
Read the full threat intel for Apple Screen Sharing bypass →
Chapters
- 0:00The hook273 Apple updates released; two now exploited.
- 0:05The storyPre-auth bypass in Screen Sharing went public.
- 0:11Attack pathExposed Screen Sharing allowed pre-auth bypass.
- 0:28AttributionNo threat actor is attributed.
- 0:33Indicators of compromise5 indicators to hunt: 2 file names and 3 paths.
- 0:38MITRE ATT&CK techniques12 ATT&CK techniques, from reconnaissance to impact.
- 0:43Remediation4 steps now: Apply the September 2026 Apple updates.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00273 Apple updates released; two now exploited.
0:05Pre-auth bypass in Screen Sharing went public.
0:08Miners then targeted exposed Macs.
0:12Exposed Screen Sharing allowed pre-auth bypass.
0:15File-transfer helpers gave them root access.
0:18Stole encryption keys and keychains.
0:21Miners hid as Apple background processes.
0:24Mined Monero in the background.
0:29No threat actor is attributed. Confidence: low.
0:335 indicators to hunt: 2 file names and 3 paths.
0:3912 ATT&CK techniques, from reconnaissance to impact.
0:444 steps now: Apply the September 2026 Apple updates.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.