You've had your iPhone stolen. A day later, you get a text from Apple saying they've found it, and a very helpful woman called Alice from Apple Support calls to walk you through recovering it. She's polite. She's professional. But she is not from Apple. She's not even human. And she's about to break into your iPhone. Meanwhile, OpenAI, Anthropic, and Meta have all announced - with varying degrees of drama - that their AI agents have "broken out of the sandbox" and gone hacking. James takes a step back and asks the awkward question: is this really an emergent AI apocalypse, or did they just leave the door open? All this and more in episode 483 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest James Ball.

The Apple OpenAI lawsuit intensifies as Apple accuses a former engineer of using stolen trade secrets to train AI agents and destroying digital evidence.

Related Posts:

• Darwin-VM Enables Apple Silicon Security Research
• Chrome Manifest V2 Removal: Legacy Extensions Are Now Gone
• Anthropic Bolsters Security After Claude AI Escapes

The post Apple OpenAI Lawsuit Escalates Over AI Trade Secrets appeared first on Daily CyberSecurity.

A newly uncovered phishing-as-a-service (PhaaS) platform called AnonyMousKIT automates the retrieval of codes used to unlock stolen Apple devices and disable the Activation Lock feature. [...]

Discover how the new ChatGPT iMessage integration on macOS operates. Uncover the severe privacy concerns and Apple's potential security retaliation.

Related Posts:

• Take-Two Subpoenas Microsoft and Discord Over GTA VI "Cyberleek" Leaks
• AliExpress Audio Fingerprinting Hijacks Your Bluetooth
• Leaked Corporate AWS Keys Expose Full Admin Rights

The post ChatGPT iMessage Integration: A macOS Privacy Clash appeared first on Daily CyberSecurity.

Apple sent a new wave of mercenary spyware threat notifications to targeted users in 110 countries, while making the warnings more visible on iPhones. The alerts signal suspected targeting, not confirmed compromise, and Apple is urging affected users to verify the warning, consider Lockdown Mode, and seek expert help.

The post Apple Warns Users in 110 Countries of Mercenary Spyware as iPhone Alerts Get Harder to Miss appeared first on TechRepublic.

Apple has released security updates for macOS, iOS, and iPadOS, addressing 28 vulnerabilities that could expose users to data leakage, application crashes, kernel memory access, and arbitrary code execution.

The updates were released on August 17, 2026, and include macOS Tahoe 26.6.2, iOS 26.6.1, iPadOS 26.6.1, iOS 18.7.10, and iPadOS 18.7.10. The company said the patches include fixes that were previously delivered through iOS, iPadOS, and macOS beta releases.

Apple follows a policy of withholding technical details about security flaws until it completes an investigation and security updates are broadly available.

Several flaws affect components that process media, web content, and graphics. Apple fixed an integer overflow in ImageIO that could allow a specially crafted image to trigger arbitrary code execution. A separate ImageIO issue could cause a denial-of-service condition when a vulnerable device processes a malicious image.

Apple Fixes 28 Security Vulnerabilities

The updates also address multiple issues in IOGPUFamily, an Apple graphics framework. Apple warned that malicious web content could cause memory corruption.

At the same time, other flaws could enable remote attackers to terminate a system unexpectedly or allow a local application to read kernel memory. Such bugs are significant because the kernel runs with high privileges and controls core operating-system functions.

An additional kernel-level issue in the older iOS 18.7.10 and iPadOS 18.7.10 releases could allow a malicious application to execute arbitrary code with kernel privileges via a buffer overflow. Apple resolved the flaw through improved size validation.

Apple patched an Audio logic issue that could allow an application to leak sensitive user information. The company addressed the problem by adding improved checks. This vulnerability affects both macOS Tahoe 26.6.2 and the newer iOS and iPadOS releases.

The mobile updates also include an Accessibility fix for devices running iOS 18.7.10 and iPadOS 18.7.10. Apple said an attacker with physical access could potentially access sensitive data during iPhone Mirroring. This feature links an iPhone with a Mac. The issue was fixed through improved state management.

CVE	Component	Affected release(s)	Impact	Vulnerability type / remediation
CVE-2026-65339	Audio	iOS/iPadOS 26.6.1; macOS Tahoe 26.6.2	An app may leak sensitive user information	Logic issue; improved checks
CVE-2026-65347	ImageIO	iOS/iPadOS; macOS	Processing an image may cause DoS	Improved checks
CVE-2026-65346	ImageIO	iOS/iPadOS; macOS	Processing an image may enable arbitrary code execution	Integer overflow; improved input validation
CVE-2026-64788	IOGPUFamily	iOS/iPadOS; macOS	Crafted web content may cause memory corruption	Improved memory handling
CVE-2026-65343	Kernel	iOS/iPadOS; macOS	Remote attacker may terminate the system	Use-after-free; improved memory management
CVE-2026-65349	Kernel	iOS/iPadOS; macOS	App may terminate the system or read kernel memory	Out-of-bounds read; improved input validation
CVE-2026-65330	Kernel	iOS/iPadOS; macOS	App may terminate the system or corrupt kernel memory	Improved memory handling
CVE-2026-65329	Telephony	iOS 26.6.1 only; iPhone 11 and later	Privileged network attacker may bypass IPSec authentication and intercept traffic	Authentication issue; improved state management
CVE-2026-64784	WebKit	iOS/iPadOS; macOS	Crafted web content may crash Safari	Out-of-bounds access; improved bounds checking
CVE-2026-43795	WebKit	iOS/iPadOS; macOS	Crafted web content may crash Safari	Improved memory handling
CVE-2026-65338	WebKit	iOS/iPadOS; macOS	Crafted web content may crash Safari	Improved memory handling
CVE-2026-65341	WebKit	iOS/iPadOS; macOS	Crafted web content may cause memory corruption	Improved memory handling
CVE-2026-64782	WebKit	iOS/iPadOS; macOS	Crafted web content may crash Safari	Memory-corruption flaw; improved locking
CVE-2026-64781	WebKit	iOS/iPadOS; macOS	Crafted web content may crash Safari	Improved input validation
CVE-2026-65351	WebKit	iOS/iPadOS; macOS	Crafted web content may crash Safari	Improved state management
CVE-2026-65340	WebKit	iOS/iPadOS; macOS	Crafted web content may crash Safari	Improved state management
CVE-2026-65337	WebKit	iOS/iPadOS; macOS	Crafted web content may crash Safari	Improved state management
CVE-2026-65336	WebKit	iOS/iPadOS; macOS	Crafted web content may crash Safari	Improved state management
CVE-2026-65335	WebKit	iOS/iPadOS; macOS	Crafted web content may crash Safari	Improved state management
CVE-2026-65333	WebKit	iOS/iPadOS; macOS	Crafted web content may crash Safari	Improved state management
CVE-2026-65332	WebKit	iOS/iPadOS; macOS	Crafted web content may crash Safari	Improved state management
CVE-2026-65331	WebKit	iOS/iPadOS; macOS	Crafted web content may crash Safari	Improved state management
CVE-2026-64715	WebKit	iOS/iPadOS; macOS	Crafted web content may cause an unexpected process crash	Use-after-free; improved memory management
CVE-2026-64780	WebKit	iOS/iPadOS; macOS	Crafted web content may crash Safari	Improved checks
CVE-2026-65334	WebKit	iOS/iPadOS; macOS	Crafted web content may crash Safari	Memory-corruption flaw; improved state management
CVE-2026-43794	WebKit	iOS/iPadOS; macOS	Crafted web content may cause memory corruption	Memory-corruption flaw; improved memory handling
CVE-2026-64787	WebKit	iOS/iPadOS; macOS	Crafted web content may terminate a process	Use-after-free; improved memory management
CVE-2026-64778	WebKit History	iOS/iPadOS; macOS	Visiting a crafted website may leak sensitive data	Improved checks
CVE-2026-64779	WebKit Storage	iOS/iPadOS; macOS	Crafted web content may crash Safari	Memory-corruption flaw; improved locking

Apple also corrected an IPSec authentication issue in iOS 26.6.1 and iPadOS 26.6.1. A threat actor in a privileged network position could bypass IPSec authentication and intercept network traffic, posing a risk to users on hostile or compromised networks.

iOS 26.6.1 and iPadOS 26.6.1 are available for iPhone 11 and later, supported iPad Pro models, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later.

The iOS 18.7.10 and iPadOS 18.7.10 updates protect older iPhone XS, iPhone XS Max, iPhone XR, and iPad 7th-generation devices. Users should install the updates promptly. Apple notes that iPhone, iPad, Apple TV, Apple Watch, and Vision Pro software cannot be downgraded after an update is installed.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Apple Fixes 28 Security Vulnerabilities Across macOS, iOS, and iPadOS appeared first on Cyber Security News.

AmnesiaStealer malware targets macOS with data theft and remote browser-session control, potentially exposing accounts already open on compromised Macs.

The post Apple Mac Malware Lets Attackers Control Browser Sessions After Infection appeared first on TechRepublic.

Apple has released security updates for iPhones, iPads, and Macs to address 28 vulnerabilities across its latest operating systems. These updates, issued on August 17, 2026, include iOS 26.6.1, iPadOS 26.6.1, macOS Tahoe 26.6.2, and security fixes for older devices with iOS 18.7.10 and iPadOS 18.7.10. The patches impact a wide range of supported Apple […]

The post Apple Addresses 28 Security Flaws Across macOS, iOS, and iPadOS appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The Dutch National Cyber Security Centre (NCSC) issued a warning after being notified of several incidents where a vulnerability in Apple’s Screen Sharing feature was exploited to install Monero cryptominers.

The vulnerability, tracked as CVE-2026-65400, was patched by Apple on August 6. It is an authentication-bypass flaw in macOS Screen Sharing that can let an attacker on the network connect without valid credentials.

macOS’s built-in Screen Sharing service is a remote-control feature commonly associated with port 5900. Successful exploitation can allow a remote attacker on a reachable network to authenticate to the service without legitimate credentials.

Apple said the bug was fixed through “improved state management,” which suggests an authentication-flow or session-state validation failure rather than a cryptographic break.

The patch was issued for macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. Practical exposure requires Screen Sharing to be enabled, so the highest-risk systems are those where port 5900 is internet-accessible, typically through a router port-forward, public IP assignment, or hosting-provider setup. Hosts reachable only from an internal network are still potentially exposed, but attackers would have to gain a position on that network.

An attacker could view and control the Mac remotely because that is the function Screen Sharing provides. NCSC says active cases involved attackers gaining root access and installing cryptomining software, specifically for Monero mining.

The criminals likely chose Monero mining because it does not depend on heavily specialized, application-specific integrated circuits (ASICs), but can be done with any CPU or GPU.

Cryptomining isn’t necessarily the worst an attacker could do. With a root-level compromise an attacker could enable persistence, data theft, credential and key harvesting, deployment of additional malware, and lateral movement.

How to stay safe

Install the update

The best way to protect your Mac is to install the update.

To update macOS on any supported Mac, use the Software Update feature, which Apple designed to work consistently across all recent versions. Here are the steps:

• Click the Apple menu in the upper-left corner of your screen.
• Choose System Settings (or System Preferences on older versions).
• Select General in the sidebar, then click Software Update on the right. On older macOS, just look for Software Update directly.
• Your Mac will check for updates automatically. If updates are available, click Update Now (or Upgrade Now for major new versions) and follow the on-screen instructions. Before you upgrade to macOS Tahoe 26, please read these instructions.
• Enter your administrator password if prompted, then let your Mac finish the update (it might need to restart during this process).
• Make sure your Mac stays plugged in and connected to the internet until the update is done.

Make sure Screen Sharing is disabled

If you can’t update immediately, check whether Screen Sharing is enabled and turn it off if you don’t use it.

1.  Click the Apple menu in the top-left corner of the screen.
2. Select System Settings.
3. In the left sidebar, click General.
4. Click Sharing on the right; you may need to scroll down.
5. Find Screen Sharing:
   • If the switch is off/grey, it is disabled.
   • If the switch is on/colored, click it to switch it off.

Also check Remote Management on that same Sharing page. It provides another remote-control route and should be off unless the owner knowingly uses it for work or IT support.

---

Macs need protection too

Malwarebytes Premium Security for Mac stops threats and protects your Mac and personal files from hackers and cybercriminals.

Apple proposes new App Store link-out fees of 5%-15%, slashing prior rates as the Epic Games legal battle heads to the Supreme Court.

Related Posts:

• Anthropic Revenue Surges 14x to $11.5B in Q2 2026 Ahead of IPO
• Stripe Finalizes $7 Billion Acquisition of OpenRouter
• SpaceX Acquires AI Coding Startup Cursor

The post Apple Proposes New App Store Link-Out Fees of 5% to 15% in Epic Legal Battle appeared first on Daily CyberSecurity.

Apple has issued mercenary spyware attack warnings to users across 110+ countries, urging immediate security action and device hardening.

Related Posts:

• Gunra Ransomware Hits Critical Infrastructure, CISA Warns
• ChainDrop npm Worm Hits 400+ Packages via Blockchain C2
• Fake Zoom Installer Drops Overlord RAT on macOS

The post Apple Sends Mercenary Spyware Alerts to Users in 110+ Countries appeared first on Daily CyberSecurity.

PoC exploit code is public for CVE-2026-43723, an Apple mediaremoted flaw that lets an app gain root privileges. CVSS 7.8. Patch now.

Related Posts:

• Roundcube Patches RCE and SSRF Flaws in 1.6.18 and 1.7.3
• CVE-2026-15826: User Profile Builder Bug Under Active Attack, Grants Full Admin Takeover (CVSS 9.8)
• CVE-2025-41771: SQL Injection Flaw Hits Phoenix Contact PLCnext

The post CVE-2026-43723: Apple mediaremoted Flaw Lets Apps Gain Root Privileges, PoC Exploit Code Publicly Disclosed appeared first on Daily CyberSecurity.

Apple warns users of credible, targeted attacks and urges immediate verification, stronger protections, and expert assistance.

Apple has sent a new round of threat notifications to users it believes may have been singled out by mercenary spyware. The company told TechCrunch the latest alerts reached people in 110 countries, adding to notifications it has already issued in more than 150 countries since the programme began in 2021.

“Apple threat notifications are designed to inform and assist users who may have been individually targeted by mercenary spyware attacks, likely because of who they are or what they do. Such attacks are vastly more sophisticated than regular cybercriminal activity, as mercenary spyware attackers apply exceptional resources to target a very small number of specific individuals and their devices.” reads the alert. “Mercenary spyware attacks cost millions of dollars and often have a short shelf life, making them much harder to detect and prevent. The vast majority of users will never be targeted by such attacks.”

That alone should reset the usual mental model. This isn’t about a suspicious app, a recycled phishing email, or the kind of opportunistic malware that lands wherever it can. Apple’s alerts concern highly targeted attacks against particular people, often because of their role, their work, or the people they know.

The people most likely to receive these notifications include journalists, activists, politicians, diplomats, lawyers, and others whose devices may hold valuable conversations, contacts, documents, or location data. That does not mean every recipient has been fully compromised, but it does mean Apple has observed enough to treat the risk as credible.

Apple has also changed how it delivers those alerts. A recipient may see a push notification directly on the iPhone lock screen and in Settings, receive an email from threat-notifications@email.apple.com, and find a warning banner after signing in to their Apple Account. The company says genuine notices will never ask users to click a link, open a file, install a profile, or provide a password or verification code by email or phone.

“Apple relies solely on internal threat-intelligence information and investigations to detect such attacks. Although our investigations can never achieve absolute certainty, Apple threat notifications are high-confidence alerts that a user has been individually targeted by a mercenary spyware attack, and should be taken very seriously.” continues the report. “We are unable to provide information about what causes us to issue threat notifications, as that may help mercenary spyware attackers adapt their behavior to evade detection in the future.”

That lack of detail can frustrate recipients. They want to know who targeted them, how the device was approached, and whether the attacker got in. Apple can’t safely answer most of those questions in public, because publishing the detection logic would give spyware vendors a free quality-assurance report. Nobody needs to make Pegasus-style operators more efficient.

If you receive the warning, don’t panic and don’t start improvising. First, verify it by signing in directly at account.apple.com: a genuine Apple threat notification appears at the top of the page. Then preserve the device, avoid unnecessary resets or changes until you have spoken to someone qualified, and seek expert help, such as the Digital Security Helpline run by Access Now.

Apple recommends enabling Lockdown Mode, its high-security setting designed to reduce the attack surface available to sophisticated spyware. It also advises keeping devices updated, using a strong passcode with Touch ID or Face ID, turning on two-factor authentication, enabling Stolen Device Protection, using strong and unique passwords or passkeys, installing apps only through the App Store, and treating unexpected links or attachments as hostile until proven otherwise.

“Since 2021, we have sent Apple threat notifications multiple times a year as we have detected these attacks, and to date we have notified users in over 150 countries in total. The extreme cost, sophistication, and worldwide nature of mercenary spyware attacks make them some of the most advanced digital threats in existence today.” states the alert. “As a result, Apple does not attribute the attacks or resulting threat notifications to any specific attackers or geographical regions.”

The wider value of these alerts goes beyond the device in front of the recipient. Citizen Lab researcher John Scott-Railton told TechCrunch that notifications can reveal that an entire community is being targeted, because people who receive them often seek help and their cases lead investigators to others.

Most people will never receive one of these warnings. Apple says that plainly, and it is worth repeating because not every cybersecurity story needs to become a universal panic. But if your phone shows an Apple notice saying it detected a targeted mercenary spyware attack, assume it matters until an expert tells you otherwise.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Apple)

Apple has expanded its threat-notification system for targets of mercenary spyware.

Apple now shows a warning directly on an iPhone’s Lock Screen and in Settings when it believes the device owner has been targeted by mercenary spyware. The new on-device alert is meant to make a high-risk warning harder to overlook and complements notifications by email and through the user’s Apple Account page.

In the explanation, Apple states:

“Apple threat notifications are high-confidence alerts that a user has been individually targeted by a mercenary spyware attack, and should be taken very seriously.”

“Apple Threat Notification
Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to help protect your data and device.”

Apple says its threat notifications are intended for people individually targeted by mercenary spyware attacks, which are highly sophisticated campaigns usually associated with commercial surveillance vendors and their government customers. Apple says it has notified targets in over 150 countries since the launch of the program in 2021, while the latest round of notifications reached people in 110 countries.

Mercenary spyware campaigns are usually not aimed at the average iPhone owner—at least at first. The initial targets are often people selected for who they are, what they know, or the work they do. But it would be a mistake to view this as someone else’s problem.

Attack techniques developed for narrowly targeted operations have a habit of spreading. Exploits can be reused, sold onward, reverse engineered, copied by other surveillance vendors, or adapted by criminal groups. A vulnerability initially valuable because it compromises a small number of carefully chosen devices may become much more dangerous once public disclosure, patch analysis, or exploit sharing makes them available for more widespread campaigns.

How to stay safe

Apple advises users to:

• Update your devices to the latest software, which includes the latest security fixes.
• Protect your devices with a passcode, Touch ID, or Face ID.
• Use two-factor authentication and a strong password for your Apple Account.
• Turn on Stolen Device Protection.
• Install apps from the App Store.
• Use strong and unique passwords, and passkeys where available.
• Don’t open links or attachments from unknown senders.

We’d like to add:

• Potential targets of mercenary spyware should consider applying Apple’s Lockdown Mode.
• Check if an Apple Threat Notification is real. Scammers will undoubtedly try and mimic them. You can verify a notification by signing in to your Apple account. A genuine Threat Notification will always be clearly listed there.
• If you receive an Apple Threat Notification, Apple recommends seeking expert help, such as the Digital Security Helpline from Access Now.

---

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

The Netherlands' National Cyber Security Centre (NCSC) is warning that hackers are actively exploiting a macOS authentication bypass vulnerability after public exploit code emerged. [...]

Apple has issued a new set of high-confidence Apple Threat Notification alerts, warning selected iPhone users in 110 countries that they may be targets of government-grade mercenary spyware. These notifications are not routine phishing messages or general security advisories. According to Apple, these alerts are sent when internal threat intelligence indicates that a sophisticated and […]

The post Apple Warns iPhone Users in 110 Countries of Mercenary Spyware Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

You're not alone if you just received an "Apple Threat Notification" saying it detected a "mercenary spyware attack targeted at your iPhone." [...]

Os usuários de Mac historicamente confiaram na segurança de seu sistema operacional. Essa tranquilidade vem principalmente do controle estrito da Apple sobre o ecossistema e do fato de que o macOS sempre enfrentou menos ataques em massa do que o Windows. No entanto, isso não significa que os computadores Mac não tenham vulnerabilidades: as ameaças existem, e novas surgem o tempo todo. Nas últimas semanas, pesquisadores de segurança publicaram relatórios sobre pelo menos duas novas campanhas direcionadas a dispositivos Apple.

O malware usado em uma das campanhas foi apelidado de CrashStealer, enquanto o outro é conhecido como ClickLock. Ambos usam truques diferentes para forçar usuários a inserir a senha do Mac, que os invasores usam para roubar credenciais de contas, ativos de criptomoedas, documentos e muito mais. No post de hoje, analisamos em detalhes como o CrashStealer funciona e como evitar ser vítima dele.

Um aplicativo de videoconferência com o CrashStealer embutido

Em maio de 2026, pesquisadores identificaram os primeiros sinais de desenvolvimento desse malware e, no início de julho, detectaram sua atuação em ambiente real. O malware recebeu esse nome devido ao seu mecanismo principal: ele se disfarça da ferramenta integrada de geração de relatórios de falhas do macOS (CrashReporter), enquanto funciona como um infostealer criado para sequestrar dados confidenciais.

Os pesquisadores conseguiram rastrear um dos sites que os usuários visitaram para baixar o malware. O site se passa por uma plataforma legítima de distribuição da ferramenta de videoconferência Werkbit.

No entanto, você não pode simplesmente visitar o site e baixar o software. Antes de iniciar o download, a pessoa precisa informar um PIN de reunião. Essa configuração provavelmente permite que os invasores limitem o alcance da campanha, direcionando-a apenas a vítimas específicas previamente selecionadas. Ainda não se sabe exatamente como os cibercriminosos escolhem seus alvos nem como entregam o PIN.

As pessoas “sortudas” que recebem um código acabam instalando a carga maliciosa inicial, chamada Werkbit Setup. Curiosamente, a carga maliciosa possui um certificado de desenvolvedor da Apple válido e foi aprovada no processo de autenticação de aplicativos da empresa, o que indica que passou pela verificação automatizada destinada a detectar código malicioso. Como resultado, os invasores conseguem contornar o Gatekeeper, mecanismo de proteção integrado do sistema operacional. Isso permite que a carga útil seja iniciada sem acionar os avisos usuais de software não confiável.

[/caption]Depois de iniciado, o Werkbit Setup primeiro se conecta ao GitHub. Pesquisadores acreditam que o uso dessa plataforma ajuda os invasores a passar despercebidos, fazendo com que as solicitações iniciais de rede pareçam muito menos suspeitas para as ferramentas de segurança. Depois de obter instruções de um repositório no GitHub, o programa se conecta diretamente ao servidor dos invasores para baixar o próprio CrashStealer.

Em seguida, o carregador salva o malware em uma pasta temporária do macOS, executa-o e apaga a maioria dos arquivos intermediários da instalação. Como resultado, em poucos segundos após a execução do Werkbit Setup, um infostealer totalmente funcional está em operação. Vale destacar que o usuário nunca recebe o aplicativo de videoconferência prometido.

Como o CrashStealer funciona

Ao contrário do carregador Werkbit Setup, o malware CrashStealer em si não é assinado com um certificado de desenvolvedor da Apple. Para evitar que os usuários desconfiem, o malware se disfarça da ferramenta de relatório de falhas do macOS, o CrashReporter, usando exatamente o mesmo nome, identificador de aplicativo e um ícone semelhante.

Depois de executado, o CrashStealer realiza uma sequência de etapas para obter acesso a dados confidenciais, estabelecer persistência no sistema e ocultar rastros:

1. Remove metadados, incluindo o atributo que identifica o aplicativo como um arquivo baixado da Internet.
2. Exibe uma solicitação falsa do sistema pedindo a senha do macOS do usuário.
3. Usa as credenciais capturadas anteriormente para acessar o Keychain, o gerenciador de senhas integrado do macOS.
4. Verifica se há ferramentas de segurança e softwares de análise de malware instalados no computador.
5. Coleta senhas salvas nos navegadores, cookies, dados do Keychain e informações de outros gerenciadores de senhas e carteiras de criptomoedas.
6. Criptografa os dados roubados e os prepara para envio ao servidor dos invasores.
7. Cria uma cópia de si mesmo e estabelece persistência para ser executado automaticamente sempre que o macOS é inicializado.
8. Exclui arquivos temporários e outros vestígios da instalação para dificultar ainda mais a detecção.

A segunda etapa merece uma análise mais detalhada. A solicitação de senha exibida ao usuário é extremamente convincente. Além disso, o malware verifica imediatamente se as credenciais estão corretas: se a pessoa cometer um erro de digitação e inserir uma senha inválida, o CrashStealer exibirá a janela novamente para que ela tente outra vez.

[/caption]

Quais dados o CrashStealer tenta roubar?

A lista de alvos do CrashStealer é extensa. O principal alvo é o Keychain, o gerenciador de credenciais integrado do macOS, onde o sistema armazena credenciais de contas, chaves criptográficas, certificados, tokens e outros dados confidenciais.

Os usuários de gerenciadores de senhas de terceiros também não estão protegidos: o malware rouba dados de 14 desses serviços, incluindo 1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass e RoboForm.

Além disso, o malware coleta todas as credenciais e cookies armazenados em navegadores baseados no Chromium (Chrome, Brave, Edge, Opera, Opera GX, Vivaldi, Chromium e NAVER Whale) bem como no Firefox. Os invasores demonstram ter um grande interesse em ativos de criptomoedas: o CrashStealer tem como alvo específico os dados de 80 extensões diferentes de carteiras de criptomoedas, incluindo MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, Exodus, Keplr e Solflare.

Por fim, o malware verifica as pastas Documentos e Downloads em busca de arquivos que possam ser de interesse dos cibercriminosos. O CrashStealer criptografa todos os dados roubados com o algoritmo AES-256-GCM, os compacta em um arquivo ZIP e os envia ao servidor dos invasores.

Como proteger seu dispositivo

O aumento dos ataques direcionados ao macOS é um claro sinal de alerta: quem usa dispositivos Apple precisa adotar uma postura mais proativa em relação à segurança. Recomendamos:

• Pesquisar sobre os aplicativos na Internet antes de instalá-los
• Dar preferência a utilitários disponíveis nas lojas de aplicativos oficiais sempre que possível
• Usar uma solução de segurança confiável que bloqueie sites maliciosos e impeça a atividade de malware no dispositivo
• Manter todas as suas credenciais e detalhes bancários em um gerenciador de senhas seguro. Uma opção é o Kaspersky Password Manager que, vale destacar, não foi listado entre os aplicativos visados pelo CrashStealer

As soluções de segurança da Kaspersky detectam o malware descrito nesta publicação e atribuem a ele os veredictos HEUR:Trojan-Downloader.OSX.Agent.gen e HEUR:Trojan-PSW.OSX.Agent.gen.

CVE-2026-20685 is a path traversal vulnerability affecting Apple’s Private Cloud Compute (PCC), potentially allowing attackers to write files as root during node boot and redirect sensitive AI inference telemetry to an external server.

Sentry Security researcher Drinor received a $150,000 Apple Security Bounty for discovering and reporting CVE-2026-20685, a flaw that could expose sensitive data and allow unauthorized access.

PCC is Apple’s server-side platform for Apple Intelligence requests that are too complex to run entirely on an iPhone, iPad, or Mac. Apple describes the system as an extension of device-level privacy protections into the cloud.

Its design relies on stateless request processing, cryptographic attestation of approved software, and tightly controlled logging systems.

The flaw was found in darwin-init, the first userspace process launched on a PCC node. Running as PID 1 with root privileges, darwin-init downloads, extracts, personalizes, and installs cryptex packages before triggering a userspace reboot into the normal operating environment.

Apple Private Cloud Compute Vulnerability

According to the Sentry Security research, darwin-init selected an archive extractor by examining only the first 4 bytes of an incoming file. A malicious tar archive did not match known Apple archive signatures and was passed to a generic extraction function.

That function appended archive entry names to the intended output path without properly validating path traversal sequences such as ../../../../.

As a result, a crafted archive could escape its extraction folder and write attacker-controlled files to persistent locations on the PCC node’s writable data volume, including /var/db/.

Because darwin-init runs as root before steady-state security services load, those files could remain available after the userspace reboot.
The researcher built a malicious archive that contained both traversal entries and a structurally valid cryptex bundle.

This was important because an invalid cryptex installation would prevent the system from completing its boot process. By combining a legitimate-looking bundle with malicious file paths, the archive could pass installation checks while placing files outside the intended extraction directory.

One demonstrated impact involved PCC’s internal splunkloggingd service. The service checks for a configuration file on the writable data volume and starts when that file exists.

By using the root file write to create a malicious logging configuration, the researcher redirected PCC telemetry to a controlled endpoint.

The redirected data reportedly included CloudBoard daemon activity, node events, and metadata associated with AI inference requests.

During test inference activity in Apple’s Virtual Research Environment, the logs exposed values such as application bundle identifiers, workload types, request identifiers, device-grouping metadata, token counts, output-token metrics, and latency measurements.

These details could reveal information about how a PCC node processes AI requests. For example, input token counts corresponded to prompt length.

At the same time, other values exposed first-token latency, speculative decoding information, and model-related telemetry. Apple’s source code reportedly identifies some of the affected metadata as information that should not be logged publicly.

The Sentry Security research also found an attestation gap. Apple’s PCC attestation process appeared to confirm that approved software and cryptotex components were installed.

However, it did not measure writable data volume files that could influence daemon behavior at runtime. A modified node could therefore appear identical to a clean node during software attestation checks.

Apple classified CVE-2026-20685 as an information disclosure issue with a CVSS score of 6.5. The company fixed the vulnerability in PCC releases 5E290.3 and later. The testing was conducted solely in Apple’s official Virtual Research Environment, with no production PCC infrastructure involved.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Apple Private Cloud Compute Flaw Enables Root File Writes and AI Inference Telemetry Leakage appeared first on Cyber Security News.

Security researcher Drinor Selmanaj has disclosed a path traversal vulnerability (CVE-2026-20685) in Apple’s Private Cloud Compute (PCC) that allows a privileged network attacker to write attacker-controlled files as root during node boot. This flaw affects the Apple Intelligence cloud-inference infrastructure. Apple has addressed the issue in PCC Release 5E290.3 and later, rating it as an […]

The post Apple Private Cloud Compute Path Traversal Flaw Lets Attackers Write Files as Root appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.