Monero Miner Execution Correlated with Recent Screen Sharing Session and Root Ancestry

Duo Tech@duotech

•updated Aug 17, 2026•0•0•11

Detects execution of Monero mining indicators by a root-privileged process descended from screensharingd or its file-copy helpers, within 30 minutes of a Screen Sharing session on the host.