apple

Apple Patches CoreGraphics Zero-Day Flaw Exploited in Attacks

,

Apple has released security updates to fix a zero-day vulnerability (CVE-2026-86950) in its CoreGraphics framework, exploited in sophisticated targeted attacks on iOS devices. The flaw, an out-of-bounds write weakness, could allow arbitrary code execution, and Apple addressed it with improved bounds checking in iOS 26.7.1, iPadOS 26.7.1, and macOS updates for impacted devices. Users are urged to install these patches promptly to prevent potential exploitation.

https://www.bleepingcomputer.com/news/security/apple-patches-coregraphics-zero-day-flaw-exploited-in-attacks/

Apple's Bug Bounty Program Is Drowning in so Much AI Slop, It Is in Danger of Missing Serious Exploits

, , ,

Apple has imposed strict limits and a 30-day cool-off period on its bug bounty submissions after being overwhelmed by low-quality, AI-generated vulnerability reports that often describe non-existent flaws. This surge in automated, plausible-sounding but false reports risks causing serious exploits, like a critical macOS zero-day, to be delayed or missed. Apple and other companies are now balancing the challenge of filtering AI slop from genuine security findings to protect their software effectively.

https://www.bitdefender.com/en-us/blog/hotforsecurity/apple-bug-bounty-ai-missing-exploits

Warning: Scammers Are Using FaceTime to Empty Bank Accounts

, , , ,

Scammers are exploiting FaceTime to conduct social engineering attacks, impersonating Apple Support or banks to trick users into revealing sensitive information or installing remote-access software, potentially leading to drained bank accounts. Apple urges users to avoid sharing personal data during unsolicited calls, keep devices updated, and report suspicious FaceTime calls to help mitigate these threats.

https://www.malwarebytes.com/blog/news/2026/07/warning-scammers-are-using-facetime-to-empty-bank-accounts

Apple’s MacOS Security Gap Lets Users Disable Security Tools

, ,

Researchers at XM Cyber discovered a macOS vulnerability that allows standard users to disable security tools like CrowdStrike Falcon EDR and Kandji MDM by exploiting flaws in how the OS caches and trusts application cryptographic hashes (CDHash). This issue enables attackers to impersonate trusted app components and invoke privileged Cross-Process Communication (XPC) services without administrator privileges, impacting numerous macOS applications relying on XPC. While some vendors have patched the flaw, Apple reportedly does not plan to fix the underlying OS issue, leaving developers to implement their own mitigations.

https://www.darkreading.com/application-security/apple-macos-security-gap-users-disable-security-tools

New macOS Stealer Campaign Uses Script Editor in ClickFix Attack

, , ,

A new macOS malware campaign delivering the Atomic Stealer exploits the built-in Script Editor app via a variation of the ClickFix attack, tricking users into running malicious scripts without manual Terminal interaction. The attack uses fake Apple-themed websites that launch Script Editor with pre-filled code to download and execute obfuscated payloads, targeting sensitive data such as Keychain items, browser passwords, and cryptocurrency wallets. Mac users are advised to treat Script Editor prompts with caution and rely only on official Apple documentation for system guidance.

https://www.bleepingcomputer.com/news/security/new-macos-stealer-campaign-uses-script-editor-in-clickfix-attack/

Apple Pushes First Background Security Improvements Update to Fix WebKit Flaw

,

Apple has released its first Background Security Improvements update to fix a WebKit vulnerability (CVE-2026-20643) affecting iPhones, iPads, and Macs without requiring a full OS upgrade. This update addresses a cross-origin flaw in the Navigation API through improved input validation and demonstrates Apple’s new ability to deliver small, out-of-band security patches in the background to enhance device security between major software releases.

https://www.bleepingcomputer.com/news/security/apple-pushes-first-background-security-improvements-update-to-fix-webkit-flaw/

Malicious OpenClaw Skills Used to Distribute Atomic macOS Stealer

, , ,

A new variant of Atomic macOS Stealer (AMOS) is being distributed through malicious OpenClaw skills, exploiting AI agentic workflows to trick users into installing the malware. The malware, disguised as a harmless skill, uses a fake dialogue box to request the user’s password and then exfiltrates sensitive data, including Apple and KeePass keychains, user documents, and system information. TrendAI™ Managed Detection and Response (MDR) customers are protected from this threat.

https://www.trendmicro.com/en_us/research/26/b/openclaw-skills-used-to-distribute-atomic-macos-stealer.html

Apple Pay Phish Uses Fake Support Calls to Steal Payment Details

, , ,

Apple Pay phishing campaign hijacks user information through fake support calls. Victims receive emails mimicking Apple alerts about unauthorized transactions, prompting them to call provided numbers. Scammers impersonate Apple agents, extracting sensitive data like Apple ID verification codes and payment details under false pretenses. Users are advised to avoid sharing 2FA codes, scrutinize sender addresses, and verify communications independently.

https://www.malwarebytes.com/blog/news/2026/02/apple-pay-phish-uses-fake-support-calls-to-steal-payment-details

A New Apple Pay Scam Is Hitting Millions

, ,

A new Apple Pay scam is targeting users by claiming suspicious transactions were blocked and urging them to call a fraudulent number. These messages, which appear official, aim to trick victims into revealing personal information. To stay safe, users should ignore such messages, verify sender details, and contact Apple directly through their website if concerned.

https://www.techradar.com/computing/cyber-security/a-new-apple-pay-scam-is-hitting-millions-heres-how-to-spot-fake-unusual-activity-messages-before-its-too-late

New MacSync Stealer Malware Attacking macOS Users Using Digitally Signed Apps

,

New MacSync Stealer malware targets macOS users via digitally signed apps, operating silently unlike older versions. Disguised as a legitimate installer, it steals sensitive information after installation. The malware can bypass macOS security due to being signed with Apple’s Developer ID. Researchers noted a shift from requiring user action to automated processes, complicating detection. Following its identification, the malicious ID was reported and revoked by Apple.

https://cybersecuritynews.com/new-macsync-stealer-malware/

Apple Sends New Round of Cyber Threat Notifications to Users in 84 Countries

Apple and Google issued cyber threat notifications to users across 84 countries, warning about potential spyware targeting. Apple noted over 150 countries informed in total, while Google highlighted specific threats from Intellexa spyware affecting hundreds of accounts in nations like Pakistan and Egypt. This move seeks to enhance user protection and may prompt investigations into spyware activities.

https://www.reuters.com/technology/apple-sent-new-round-cyber-threat-notifications-users-84-countries-2025-12-05/

Google’s AI ‘Big Sleep’ Finds 5 New Vulnerabilities in Apple’s Safari WebKit

, ,

Google's AI “Big Sleep” found five vulnerabilities in Apple's Safari WebKit, potentially leading to crashes or memory corruption. Apple released patches in iOS 26.1, iPadOS 26.1, and other systems to address these issues. Big Sleep is part of a Google initiative for automated vulnerability discovery, having previously identified risks in other software. Keeping devices updated is recommended for optimal security.

https://thehackernews.com/2025/11/googles-ai-big-sleep-finds-5-new.html

Large-Scale Attack Targeting Macs Via GitHub Pages Impersonating Companies to Attempt to Deliver Stealer Malware

, ,

TLDR: A large-scale cyberattack targets Mac users through fake GitHub pages impersonating companies, promoting the installation of an infostealer malware called Atomic. The malicious sites use SEO tactics to appear high in search results, redirecting users to download malware after entering commands. LastPass has taken down some fraudulent sites and continues to monitor the situation.

https://blog.lastpass.com/posts/attack-targeting-macs-via-github-pages

Scroll to Top