Recover Data After a macOS Malware or Hacking Incident: CVE-2026-65400 Guide

If malware or an intruder deleted, encrypted, renamed, or corrupted files on your Mac, do not treat the incident as an ordinary undelete job. A rushed scan, reinstall, backup connection, or password change from the compromised Mac can overwrite recoverable data, destroy evidence, expose new credentials, or restore the attacker along with your files.

This guide uses the actively exploited macOS Screen Sharing vulnerability CVE-2026-65400 as a real 2026 example. It explains how to contain the Mac, verify and install Apple's fix, recover clean copies from Trash, iCloud, or Time Machine, use Wondershare Recoverit for Mac when files were actually deleted, and decide when a forensic responder or data recovery laboratory is the safer choice.

Part 1. CVE-2026-65400: What Is Confirmed?

The Confirmed macOS Screen Sharing Risk

Apple's Tahoe 26.6.1 security note describes CVE-2026-65400 as an authentication issue in Screen Sharing. Apple says an attacker on the network may be able to authenticate without valid credentials. The same fix appears in the official notes for macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9. All three updates were released on August 6, 2026.

The vulnerability affects macOS Screen Sharing, which uses the Remote Framebuffer protocol associated with VNC. Apple's Mac User Guide says Mac Screen Sharing uses TCP port 5900 by default. A different port can be configured, so checking only 5900 is not enough to prove a system was never exposed.

The Netherlands National Cyber Security Centre advisory NCSC-2026-0280 is especially important because it goes beyond theoretical impact. NCSC-NL says it received a report of active exploitation on multiple systems where port 5900 was reachable from the internet. In every observed case described by the advisory, the attacker obtained root access and installed a Monero cryptocurrency miner.

This does not mean every Mac was remotely compromised. The documented risk is highest when a vulnerable Mac has Screen Sharing or related remote management exposed to an attacker through the local network, port forwarding, a hosted Mac environment, or another reachable network path.

Who Is Exposed?

Huntress research explains that the flaw occurs before successful authentication and that common configuration changes such as rotating a VNC password or removing allowed Screen Sharing users do not correct the vulnerable code. The durable fix is the Apple security update. Disabling Screen Sharing is a temporary exposure-reduction step when immediate patching is impossible.

Timeline and Severity

Severity numbers currently differ by source. The NCSC-NL page displays CVSS 3.1 7.1, while the NVD record shows a CISA-ADP CVSS 3.1 score of 9.8 Critical as of its August 15 modification. The safe editorial approach is to disclose the source and date of the score rather than present one number as universally settled.

Part 2. Contain the Mac Before Recovering Files

Data recovery and security incident response solve different problems. Recovery tries to retrieve files. Incident response tries to stop the attacker, preserve evidence, determine scope, remove persistence, and prevent reinfection. Start scanning too early and you may recover files onto a system the attacker still controls.

Home User Response

1. Disconnect the network: Unplug Ethernet and turn off Wi-Fi. If the Mac is a hosted or remote machine, use the provider's console or network controls to isolate it.
2. Stop using the Mac for email, banking, or passwords: A root-level compromise can undermine trust in the running system. Use a separate, clean device for sensitive accounts.
3. Record what you see: Photograph ransom notes, miner warnings, unfamiliar remote sessions, file extensions, login alerts, dates, and error messages. Do not open suspicious attachments to identify them.
4. Secure the Apple Account from a clean device: Follow Apple's compromised Apple Account guidance, change the password, review personal information, remove unrecognized devices, and confirm two-factor authentication.
5. Protect other credentials: Prioritize email, password manager, financial, cloud storage, social media, developer, and work accounts. Use unique passwords and revoke unknown sessions or app tokens.
6. Do not connect backup disks yet: Wait until the Mac is contained or rebuilt. A writable backup attached to an active compromise can be altered, encrypted, or contaminated.
7. Decide whether professional help is needed: If the Mac stored business records, private client data, cryptocurrency keys, legal evidence, or irreplaceable work, stop before making system changes.

If the Mac can be isolated and evidence matters, leaving it powered but unused can preserve volatile information for a responder. If destructive encryption or deletion is visibly continuing and no qualified help is available, powering it down may limit further damage. Organizations should follow their incident-response policy instead of improvising.

Business and Forensic Response

For a company-owned Mac, notify IT or the security team before changing files, uninstalling software, or applying the patch. A root compromise may require investigation of identity systems, remote-access logs, network traffic, other Macs, cloud tokens, and data-exfiltration risk. Legal, regulatory, contractual, cyber-insurance, or law-enforcement obligations may also apply.

NIST SP 800-61 Revision 3 frames incident response as part of broader cybersecurity risk management. For high-impact incidents, capture and preserve the evidence required by the organization's response plan before patching or erasing the endpoint. File recovery should work from an authorized forensic image or responder-approved copy when chain of custody matters.

Actions That Can Make Recovery Worse

• Do not erase or reinstall before securing the required files: Erasure may remove remaining recoverable data and incident evidence.
• Do not install multiple cleaners or recovery tools on the source volume: Every installation, update, log, and cache writes new data that may overwrite deleted content.
• Do not save recovered files to the affected disk: Use a separate, clean external SSD or HDD.
• Do not restore an entire old system blindly: A full-system backup can restore malicious apps, launch agents, configuration profiles, scripts, browser extensions, or persistence created before the backup.
• Do not reconnect iCloud and other sync services until account access is secure: Malicious deletion can synchronize to other devices, and restored files can be removed again.
• Do not run Disk Utility First Aid as an undelete method: First Aid repairs file-system structures. It does not reconstruct ordinary deleted files and can change metadata.
• Do not trust random decryptors or driver downloads: Use tools recommended by a known security vendor, government advisory, or responder for the exact malware family.

Part 3. Determine What Happened to the Files

Users often describe every post-incident problem as “my files are gone,” but the correct recovery method depends on whether the files were deleted, moved, hidden, encrypted, corrupted, locked by permissions, or made inaccessible by a damaged disk.

Build a small loss inventory before recovery: original folder, filename or extension, approximate size, last known good date, whether a clean backup exists, and whether the file contains sensitive information. This prevents hours of scanning for files that are already available in a safer source.

Part 4. Patch the Mac and Close the Screen Sharing Entry Point

Install the Correct macOS Security Update

If an organization needs evidence, coordinate patch timing with the responder. Otherwise, once important files and evidence are protected, open Apple menu, System Settings, General, and Software Update. Apple recommends using the latest macOS compatible with the Mac.

Do not assume “Your Mac is up to date” means the Mac received one of these specific builds without checking the version. Software Update offers only releases compatible with the Mac model and installed macOS branch.

Disable Unneeded Remote Access

1. Open Sharing settings: Go to System Settings, General, and Sharing.
2. Turn off Screen Sharing: Apple's guide confirms that other computers cannot connect through Mac Screen Sharing when it is off.
3. Check Remote Management: Screen Sharing and Remote Management cannot be enabled at the same time in the standard settings, but either remote-control path should be reviewed.
4. Remove public exposure: Delete router port-forwarding rules, cloud firewall rules, and provider security-group rules that publish VNC or Screen Sharing directly to the internet.
5. Use a protected management path: If remote access is required, restrict it through a trusted VPN, allowlisted administration network, or a managed remote-access service with logging and strong authentication.
6. Review authorized users: After patching, permit only accounts that need access. Do not use “All users” for convenience on an exposed or shared network.

Turning off legacy VNC password authentication alone does not remediate this pre-authentication flaw, according to Huntress. Patch the operating system even if the VNC password option was never enabled.

Why Patching Alone Is Not Incident Cleanup

The update closes the vulnerable authentication path. It does not automatically remove a miner, launch item, altered shell configuration, stolen token, unknown administrator, or other persistence installed before the patch. A Mac with credible compromise indicators should be investigated and, in many cases, erased and rebuilt from a trusted source after data preservation.

Apple's platform security documentation explains that macOS includes Gatekeeper, Notarization, and XProtect layers. XProtect can block and remediate known malware, but no built-in control is a substitute for incident scoping after confirmed root access. Update macOS and its security data, then use an organization-approved endpoint security tool or qualified responder to assess the system.

Part 5. Recover Clean Copies Without Recovery Software

Check Trash, iCloud, and App Versions

1. Check Trash after containment: If the missing items are present, inspect their dates and restore only known data files. Do not restore unknown apps, scripts, packages, or executables.
2. Search with Finder and Spotlight: Search by filename, extension, content, and date. Inspect the correct folder under /Users/ in case the intruder changed the active account or moved data.
3. Use iCloud from a clean device: Apple says iCloud.com can recover eligible files deleted from iCloud Drive and other apps within the previous 30 days, unless they were permanently removed.
4. Check app version history: Pages, Numbers, Keynote, Microsoft 365, Adobe apps, source-control systems, and cloud collaboration tools may retain earlier versions separate from the local file.
5. Export to a clean location: Download recovered copies to a clean external drive or a trusted rebuilt Mac. Keep the originals unchanged until the incident is resolved.

For iCloud Drive, sign in at iCloud.com, open iCloud Drive, select Recently Deleted, and recover the required files. Apple also provides Data Recovery under iCloud settings for files deleted by supported apps. Avoid editing or deleting iCloud Drive data while recovery is running.

Restore Files from a Clean Time Machine Snapshot

Time Machine is often the best recovery path because it can restore an intact version with its original name, folder, and metadata. Choose a snapshot from before the first suspicious remote session, miner activity, password alert, or unexpected file change.

1. Connect the backup only to a trusted environment: Prefer a rebuilt Mac or a responder-approved system. Do not expose a healthy backup to an active compromise.
2. Open the original folder: In Finder, navigate to the folder that contained the missing file.
3. Open Time Machine: Browse snapshots and select a date before the incident.
4. Restore selected data first: Recover documents, photos, videos, and projects. Avoid restoring unfamiliar applications, login items, scripts, configuration profiles, or system settings.
5. Scan and validate: Check restored files with updated security software, open representative files, and verify their contents before returning them to production use.

A backup created after the compromise may contain useful documents and malware at the same time. Treat it as evidence or a recovery source, not proof of cleanliness. Restore selected data rather than migrating the entire compromised environment.

Part 6. Recover Files Deleted by Malware with Recoverit

When Recoverit Is an Appropriate Option

Use data recovery software after the threat is contained when the files were deleted or lost from readable storage and no clean backup contains them. This path is particularly relevant to external HDDs, USB drives, SD cards, Time Machine disks, and other media that have not been overwritten.

The current Recoverit for Mac product page lists support for macOS Tahoe 26, Sequoia 15, Sonoma 14, Apple silicon and T2 Macs, and file systems including APFS, HFS, and HFS+. It also lists virus infection as a recovery scenario. These are vendor-stated compatibility claims, not a guarantee that data encrypted, overwritten, securely erased, or removed by SSD garbage collection can be recovered.

Step-by-Step Mac Malware Data Recovery

1. Prepare a trusted recovery environment: If possible, use a clean Mac and connect the affected external drive as a secondary device. For a compromised internal drive or evidence-sensitive case, ask a responder to create a forensic image first.
2. Prepare a separate destination: Connect a clean external SSD or HDD with enough free space. The source and destination must not be the same physical device.
3. Install Recoverit safely: Download it from the official Recoverit page. Avoid installing it onto the volume that contained the deleted files whenever another startup or application volume is available.
4. Select the correct source: Confirm the drive name, capacity, and original file location. Choose the affected external drive, volume, Desktop shortcut, or authorized disk image.
5. Start the scan: Let Recoverit search the selected storage. Avoid using the source for other work while scanning.
6. Filter by the loss inventory: Narrow results by extension, file type, date, size, path, or known filename. Search for high-priority files before selecting everything.
7. Preview representative files: A successful preview is useful evidence that content is present, but every recovered file still needs validation.
8. Recover to the clean destination: Never save results back to the affected source disk.
9. Scan the recovered data: Use updated security software in a trusted environment. Do not open unknown apps, shell scripts, installers, browser extensions, macros, or configuration profiles.
10. Verify content and maintain two copies: Open important documents and media, compare expected sizes, and preserve a second copy before erasing or rebuilding the Mac.

For ordinary deletion workflows, see the Recoverit guide to recovering permanently deleted files on Mac. For files that merely disappeared from the desktop, check the narrower guide to recovering missing Mac desktop files before starting a full scan.

Limits on Apple Silicon, SSDs, and Encryption

• SSD deletion can become irreversible quickly: Continued use, TRIM-related behavior, garbage collection, and new writes can remove or overwrite data that a scanner would otherwise find.
• FileVault requires authorized access: Recovery software cannot bypass FileVault or reconstruct data without the valid credentials or recovery mechanism needed to unlock the volume.
• Apple silicon internal storage is not a removable drive: Hardware integration, encryption, and storage management make many internal SSD cases less recoverable than an external HDD or memory card.
• Overwritten files cannot be restored by scanning: A new file, malware payload, update, or log may occupy the same storage blocks.
• A found filename is not proof of an intact file: Metadata may survive when the content is partly overwritten. Preview and open the recovered copy.
• Software cannot repair physical failure: If the drive disappears, disconnects, reports the wrong capacity, or produces hardware errors, stop scanning.

Part 7. What If the Files Were Encrypted or Corrupted?

Encryption and deletion are different. Deleted-file software searches for file content that remains on storage. Ransomware transforms file content with a cryptographic key. If the encrypted file still occupies the disk, an undelete scan will usually find the same encrypted bytes rather than the original document.

1. Preserve samples: Keep copies of the ransom note, one or two encrypted files, original extensions, and observed timestamps. Do not rename every file in bulk.
2. Identify the malware through a trusted responder: A known family may have a legitimate decryptor, but many do not. Do not upload sensitive client documents to a public identification service without authorization.
3. Check versioned backups: Time Machine, iCloud, collaboration platforms, source control, and offline backups may contain pre-encryption versions.
4. Look for deleted originals on copied storage: Some ransomware creates an encrypted copy and deletes the original. A scan of an authorized forensic image or affected external disk may find the deleted original if it has not been overwritten.
5. Repair only after recovery: If a file is recovered but damaged, duplicate it before attempting document, photo, or video repair. Repair changes the file and is not a substitute for retrieving the best source copy.

Do not promise decryption, and do not claim a data recovery tool can reverse cryptography. The best outcomes usually come from a clean pre-incident backup, a legitimate decryptor for the exact malware family, or recovery of deleted originals that remain intact.

Part 8. Recover Data When the Mac Will Not Start

Use macOS Recovery Carefully

A Mac that will not boot may have damaged system files, file-system errors, a full disk, malware persistence, or unrelated hardware failure. If the files are critical, attempt data preservation before erase or reinstall.

1. Start macOS Recovery: On Apple silicon, shut down, press and hold the power button until startup options appear, select Options, and continue. On an Intel Mac, start the Mac and use the appropriate Command-R recovery shortcut.
2. Confirm the disk appears: Open Disk Utility and choose View, Show All Devices. If the internal drive is missing or repeatedly disconnects, stop and seek professional help.
3. Recover or image important data first: A business incident should use an approved forensic process. A home user with a readable secondary drive can recover authorized data to an external destination.
4. Use First Aid only for file-system errors: Apple says Disk Utility can repair formatting and directory-structure errors. It is not a deleted-file recovery method.

Apple recommends having a current backup before First Aid. In a malware case, preserve critical files and evidence before allowing a repair utility to modify file-system metadata. If Disk Utility cannot repair the volume, its next official option may involve erasing the disk, which is why recovery must come first.

Know When to Stop DIY Recovery

• The internal disk is absent in Disk Utility or startup options.
• The Mac powers off, overheats, or restarts repeatedly during access.
• An external drive clicks, disconnects, or reports inconsistent capacity.
• FileVault credentials are unavailable or the authorized recovery process fails.
• The case involves legal evidence, regulated data, employee monitoring, or suspected data theft.
• The lost data is irreplaceable and one failed scan would materially reduce the chance of laboratory recovery.

Repeated scans do not make a failing device healthier. A professional recovery laboratory can evaluate physical storage problems, while a digital forensics and incident response provider can preserve evidence and investigate compromise. Some cases require both.

Part 9. Rebuild macOS Without Restoring the Malware

After confirmed root compromise, cleaning individual files may not provide enough assurance. The safer endpoint-recovery strategy is often to preserve required data, erase the Mac through Apple's supported process, reinstall a fully patched macOS, and restore selected clean data.

1. Confirm recovery is complete: Keep at least two verified copies of important data before erasing anything.
2. Preserve the evidence required by policy: Do not destroy the only disk image, log export, or incident timeline.
3. Erase and reinstall macOS: Use Apple's official macOS Recovery or Erase All Content and Settings workflow that applies to the Mac model and operating system.
4. Install all updates before restoration: Confirm Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9, or a later patched release.
5. Create fresh credentials: Use a new administrator password and restore account access from a clean device. Revoke old sessions and tokens.
6. Reinstall apps from trusted sources: Download current versions from the App Store or verified vendor websites. Do not migrate unknown packages from the compromised Mac.
7. Restore selected data: Documents, photos, videos, and known project files are safer than a blind full-system migration. Scan them before opening.
8. Monitor the rebuilt Mac: Watch for renewed high CPU, unknown network connections, unauthorized login alerts, unfamiliar profiles, or unexpected Screen Sharing activity.

If the miner or other malware returns after a clean rebuild, investigate shared credentials, cloud sync, restored launch items, network appliances, management profiles, and other devices. Repeating the same restore without identifying the source can recreate the incident.

Part 10. Compare Every Recovery Path

Part 11. Prevent Another macOS Intrusion

• Keep macOS and security data updated: Enable automatic updates and verify important security builds instead of relying only on notification banners.
• Turn off Screen Sharing and Remote Management when unused: Remote-control services should not remain enabled for occasional convenience.
• Never publish VNC directly to the internet: Remove port forwarding and restrict remote administration through a protected, logged management path.
• Use separate standard and administrator accounts: Apple recommends limiting administrator users because compromise of an administrator can cause greater harm.
• Use FileVault and protect its recovery method: Encryption reduces data exposure from stolen hardware, but losing authorized recovery access can also prevent legitimate recovery.
• Maintain versioned and offline backups: Keep one backup that is not continuously writable from the Mac. Test restoration instead of assuming the backup works.
• Protect the Apple Account with two-factor authentication: Review trusted devices and security information regularly.
• Install apps from trusted sources: Keep Gatekeeper, Notarization, XProtect updates, and browser protections enabled.
• Monitor hosted Macs separately: Verify the provider's base image, firewall, remote-access configuration, update schedule, and incident notification process.
• Document a recovery plan: Know who owns containment, evidence preservation, account recovery, backups, data recovery, and clean rebuilds before an incident happens.

Part 12. Final Verdict

Recovering data after a Mac hacking or malware incident is possible only when the recovery method matches the loss. Start with containment and account security, then prefer intact copies from iCloud, Time Machine, version history, or offline backups. Use Recoverit when files were deleted from readable storage and no clean copy exists. Do not use it as a malware cleaner, decryptor, or forensic substitute.

For CVE-2026-65400, the minimum patched builds are macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. A Mac exposed through Screen Sharing before patching deserves investigation because NCSC-NL has reported real attacks that obtained root access and installed a Monero miner. Patching closes the vulnerability, but a previously compromised Mac may still need a clean rebuild.

The most important recovery rule is simple: do not erase, repair, reinstall, or restore blindly. Preserve what matters, work from a trusted environment, recover to separate storage, and verify both the files and the rebuilt system before returning to normal use.