Tag: macOS
-
Open Directory Exposure Leaks BYOB Framework Across Windows, Linux, and macOS
An exposed command-and-control server hosting a complete deployment of the BYOB (Build Your Own Botnet) framework, a sophisticated post-exploitation tool targeting Windows, Linux, and macOS systems. The discovery, made through Hunt.io’s AttackCapture tooling, reveals an active campaign that has operated for approximately ten months with multi-platform remote access capabilities and integrated cryptocurrency mining operations. The…
-
Logitech macOS mouse mayhem traced to expired dev certificate
Tags: macOSCompany says it dropped the ball, apologizes for wasting people’s time First seen on theregister.com Jump to article: www.theregister.com/2026/01/08/logitech_mouse_chaos/
-
Malicious NPM Packages Deliver NodeCordRAT
IntroductionZscaler ThreatLabz regularly monitors the npm database for suspicious packages. In November 2025, ThreatLabz identified three malicious packages: bitcoin-main-lib, bitcoin-lib-js, and bip40. The bitcoin-main-lib and bitcoin-lib-js packages execute a postinstall.cjs script during installation, which installs bip40, the package that contains the malicious payload. This final payload, named NodeCordRAT by ThreatLabz, is a remote access trojan (RAT) with data-stealing capabilities. It is also possible to download bip40…
-
Malicious NPM Packages Deliver NodeCordRAT
IntroductionZscaler ThreatLabz regularly monitors the npm database for suspicious packages. In November 2025, ThreatLabz identified three malicious packages: bitcoin-main-lib, bitcoin-lib-js, and bip40. The bitcoin-main-lib and bitcoin-lib-js packages execute a postinstall.cjs script during installation, which installs bip40, the package that contains the malicious payload. This final payload, named NodeCordRAT by ThreatLabz, is a remote access trojan (RAT) with data-stealing capabilities. It is also possible to download bip40…
-
Logitech Options+, G HUB macOS apps break after certificate expires
Logitech’s Options+ and G Hub apps on macOS stopped working after their code-signing certificate expired, leaving users unable to launch them on Apple systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/hardware/logitech-options-plus-g-hub-macos-apps-break-after-certificate-expires/
-
Logitech Options+, G HUB macOS apps break after certificate expires
Logitech’s Options+ and G Hub apps on macOS stopped working after their code-signing certificate expired, leaving users unable to launch them on Apple systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/hardware/logitech-options-plus-g-hub-macos-apps-break-after-certificate-expires/
-
Logitech Options+, G HUB macOS apps break after certificate expires
Logitech’s Options+ and G Hub apps on macOS stopped working after their code-signing certificate expired, leaving users unable to launch them on Apple systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/hardware/logitech-options-plus-g-hub-macos-apps-break-after-certificate-expires/
-
Critical macOS Flaw Lets Attackers Bypass Apple Privacy Controls Without Consent
A newly disclosed macOS vulnerability bypasses Apple’s TCC privacy controls, allowing silent access to files, microphone data, and user activity. The post Critical macOS Flaw Lets Attackers Bypass Apple Privacy Controls Without Consent appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-macos-flaw-apple-privacy-controls/
-
macOS Flaw Enables Silent Bypass of Apple Privacy Controls
A macOS vulnerability (CVE-2025-43530) allows attackers to silently bypass TCC privacy controls and access sensitive user data. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/macos-flaw-enables-silent-bypass-of-apple-privacy-controls/
-
Product showcase: Blokada for Android gives users control over network traffic
Blokada is a network privacy and ad-blocking application available on Android, iOS, Windows, macOS, and Linux. It is designed to reduce ads, block trackers, and limit unwanted … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/01/06/product-showcase-blokada-android-control-network-traffic/
-
Einheitliches Gerätemanagement für macOS – Cortado erweitert MDM-Plattform um Mac-Management
Tags: macOSFirst seen on security-insider.de Jump to article: www.security-insider.de/cortado-erweitert-mdm-plattform-um-mac-management-a-7054066857997770a15e6eed37c3a8a9/
-
New GlassWorm malware wave targets Macs with trojanized crypto wallets
A fourth wave of the “GlassWorm” campaign is targeting macOS developers with malicious VSCode/OpenVSX extensions that deliver trojanized versions of crypto wallet applications. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-glassworm-malware-wave-targets-macs-with-trojanized-crypto-wallets/
-
ThreatsDay Bulletin: GhostAd Drain, macOS Attacks, Proxy Botnets, Cloud Exploits, and 12+ Stories
The first ThreatsDay Bulletin of 2026 lands on a day that already feels symbolic, new year, new breaches, new tricks. If the past twelve months taught defenders anything, it’s that threat actors don’t pause for holidays or resolutions. They just evolve faster. This week’s round-up shows how subtle shifts in behavior, from code tweaks to…
-
GlassWorm Malware Turns VS Code Extensions into an Attack Vector Against macOS
GlassWorm has returned with a dangerous new evolution. The notorious self-propagating malware, which first surfaced in October as an invisible Unicode-based threat in VS Code extensions, has completed a significant platform pivot to macOS with 50,000 downloads and a fully operational infrastructure. Security researchers have identified three malicious extensions on the Open VSX marketplace linked…
-
New MacSync macOS Stealer Uses Signed App to Bypass Apple Gatekeeper
Cybersecurity researchers have discovered a new variant of a macOS information stealer called MacSync that’s delivered by means of a digitally signed, notarized Swift application masquerading as a messaging app installer to bypass Apple’s Gatekeeper checks.”Unlike earlier MacSync Stealer variants that primarily rely on drag-to-terminal or ClickFix-style techniques, this sample adopts a more First seen…
-
Reworked MacSync Stealer Adopts Quieter Installation Process
A newly discovered macOS malware mimics legitimate apps code-signed and notarized by Apple First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/signed-variant-macsync-stealer/
-
MacSync Stealer Malware Targets macOS Users Through Digitally Signed Apps
Jamf Threat Labs has uncovered a new MacSync Stealer campaign that significantly raises the bar for macOS malware delivery by abusing Apple’s own trust mechanisms. The latest variant is delivered as a fully code”‘signed and notarized Swift application, allowing it to masquerade as legitimate software while executing a stealthy, multi”‘stage infostealing routine in the background.…
-
New MacSync malware dropper evades macOS Gatekeeper checks
The latest variant of the MacSync information stealer targeting macOS systems is delivered through a digitally signed, notarized Swift application. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-macsync-malware-dropper-evades-macos-gatekeeper-checks/
-
pearOS is a Linux that falls rather close to the Apple tree
Revived distro returns on Arch with KDE Plasma, global menus, and a familiar macOS-style sheen First seen on theregister.com Jump to article: www.theregister.com/2025/12/19/pearos/
-
Hacking Hardware, Unraveling Malware: Black Hat Europe at 25
Also: macOS Naughty or Nice, Cybercrime Karma, Spoofing Legacy Rail Infrastructure London in December: Early to dark, quick to rain but also festive – and a mecca for cybersecurity researchers there for the annual Black Hat Europe conference. This year’s event featured nearly 50 briefings that touched on everything from hardware hacking to combing infostealer…
-
Hacking Hardware, Unraveling Malware: Black Hat Europe at 25
Also: macOS Naughty or Nice, Cybercrime Karma, Spoofing Legacy Rail Infrastructure London in December: Early to dark, quick to rain but also festive – and a mecca for cybersecurity researchers there for the annual Black Hat Europe conference. This year’s event featured nearly 50 briefings that touched on everything from hardware hacking to combing infostealer…
-
CISA Alerts on Apple WebKit Zero-Day Actively Used in Cyberattacks
Tags: apple, cisa, cve, cyber, cyberattack, cybersecurity, exploit, infrastructure, kev, macOS, risk, vulnerability, zero-dayThe Cybersecurity and Infrastructure Security Agency (CISA) has added a critical zero-day vulnerability affecting multiple Apple products to its Known Exploited Vulnerabilities (KEV) catalog, signaling active exploitation in the wild. CVE-2025-43529 represents a severe use-after-free vulnerability in WebKit, Apple’s rendering engine, that poses a significant risk to millions of users across iOS, iPadOS, macOS, and other…
-
CISA Alerts on Apple WebKit Zero-Day Actively Used in Cyberattacks
Tags: apple, cisa, cve, cyber, cyberattack, cybersecurity, exploit, infrastructure, kev, macOS, risk, vulnerability, zero-dayThe Cybersecurity and Infrastructure Security Agency (CISA) has added a critical zero-day vulnerability affecting multiple Apple products to its Known Exploited Vulnerabilities (KEV) catalog, signaling active exploitation in the wild. CVE-2025-43529 represents a severe use-after-free vulnerability in WebKit, Apple’s rendering engine, that poses a significant risk to millions of users across iOS, iPadOS, macOS, and other…
-
Apple Releases macOS Sequoia 15.7.3 Security Update
Apple has released macOS Sequoia 15.7.3 with important security fixes. Here’s what to know before installing the update. The post Apple Releases macOS Sequoia 15.7.3 Security Update appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-apple-macos-sequoia-security-update/
-
Apple Releases macOS Sequoia 15.7.3 Security Update
Apple has released macOS Sequoia 15.7.3 with important security fixes. Here’s what to know before installing the update. The post Apple Releases macOS Sequoia 15.7.3 Security Update appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-apple-macos-sequoia-security-update/
-
Apple Releases macOS Sequoia 15.7.3 Security Update
Apple has released macOS Sequoia 15.7.3 with important security fixes. Here’s what to know before installing the update. The post Apple Releases macOS Sequoia 15.7.3 Security Update appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-apple-macos-sequoia-security-update/
-
Apple Releases macOS Sequoia 15.7.3 Security Update
Apple has released macOS Sequoia 15.7.3 with important security fixes. Here’s what to know before installing the update. The post Apple Releases macOS Sequoia 15.7.3 Security Update appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-apple-macos-sequoia-security-update/