threat-intel In Other News: Iran Tracks US Military Phones, CrashStealer macOS Malware, CVD Blueprint This week’s cybersecurity news highlights a range of concerning events, including a Dutch telecom breach potentially linked to local cybercriminals, a Lidl data breach impacting customers in Belgium and the Netherlands,… SecurityWeek · Jul 17, 2026 High NEBEGEcyberattackransomwaredata breach
threat-intel ‘ClickLock Stealer’ Bypasses macOS Security With Social Engineering, Process Killing ClickLock Stealer, a new macOS malware, bypasses macOS security through social engineering and aggressive process killing to steal sensitive data, including browser data, cryptocurrency wallets, and password manager info… SecurityWeek · Jul 16, 2026 High DEFRITmacossocial engineeringprocess killing
threat-intel New ClickLock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password A new macOS infostealer, dubbed ClickLock Stealer, is actively targeting users by forcing them to enter their passwords repeatedly through a loop of killing apps. The malware, a copy of GSocket, uses a deceptive Cloudfla… The Hacker News · Jul 16, 2026 High EUmacosinfostealerpassword
threat-intel CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks A new macOS information stealer, CrashStealer, is utilizing a sophisticated delivery chain involving a notarized dropper to bypass Gatekeeper and silently collect sensitive data from users. The malware, implemented in na… The Hacker News · Jul 13, 2026 High macosinformation stealernotarized dropper
malware PamStealer Uses Fake Maccy Sites and PAM Checks to Steal Mac Login Passwords PamStealer, a new macOS information stealer developed by Jamf Threat Labs, utilizes deceptive tactics like mimicking the Maccy clipboard manager and exploiting Pluggable Authentication Modules (PAM) to steal login creden… The Hacker News · Jul 3, 2026 High RUBYKZmacosstealercredential theft
threat-intel And the Winner in Dominant Malware Delivery? ClickFix ClickFix, a social engineering technique where attackers trick users into executing malicious commands via error messages, has become the dominant method for malware delivery, according to a recent ReliaQuest analysis. T… Dark Reading · Jul 1, 2026 High USsocial engineeringmalware deliveryobfuscation
vulnerability AirDrop and Quick Share Flaws Let Nearby Attackers Trigger Crashes and Bypass Checks Researchers have identified six security flaws in AirDrop and Quick Share, wireless file-sharing features used on Apple and Samsung devices. These vulnerabilities allow an attacker within range to trigger crashes, bypass… The Hacker News · Jun 30, 2026 High CVE-2024-38271CVE-2024-38272CVE-2024-10668USGBairdropquicksharecrash
threat-intel In Other News: Chinese Mythos-Like AI, Tata Electronics Breach, Snyk Layoffs This week’s cybersecurity news includes a Russian government operation utilizing Cellebrite software to target an opposition activist, a Scattered Spider group breach of Transport for London, and a significant data leak… SecurityWeek · Jun 26, 2026 High RUUKINaicyberespionagesupply chain
threat-intel New macOS malware embeds fake errors to confuse AI analysis tools A new macOS malware, dubbed "Gaslight," has been discovered that employs a deceptive tactic to mislead AI-powered malware analysis tools. The malware embeds fabricated error messages and debugging data within its Rust bi… BleepingComputer · Jun 25, 2026 Medium NOmacosai analysisprompt injection
threat-intel New Gaslight macOS Malware Uses Prompt Injection to Disrupt AI-Assisted Analysis A new macOS malware, dubbed Gaslight, has been discovered using prompt injection techniques to deceive AI-powered analysis tools. Developed by North Korea-aligned threat actors, the malware steals information and attempt… The Hacker News · Jun 25, 2026 High KPmacosprompt injectionai evasion
threat-intel Apple's MacOS Gap Lets Users Disable Security Tools This article details a macOS security vulnerability discovered by XM Cyber that allows standard users to disable enterprise security tools like CrowdStrike Falcon EDR and Kandji MDM without administrator privileges. The… Dark Reading · Jun 24, 2026 High CVE-2026-39118USmacosxpccdhash
supply-chain OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat This report details a significant supply chain attack leveraging OpenClaw’s Skill Marketplace, highlighting the emerging threat of AI agentic software. Malicious skills, including infostealers and evasion techniques, wer… Palo Alto Unit 42 · Jun 23, 2026 High USaiagenticsupply chain
malware New macOS ClickFix attack silently mounts DMGs to push infostealer A new macOS ClickFix campaign is using Terminal commands to silently deploy the Atomic macOS Stealer (AMOS) infostealer, targeting users through fake CAPTCHA pages. The malware steals sensitive data like browser credenti… BleepingComputer · Jun 23, 2026 High USmacosclickfixinfostealer
threat-intel Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered Palo Alto Unit 42 has discovered a new Biome stream, ‘App.MenuItem,’ in macOS Tahoe 26 that logs specific menu selections made by users. This artifact provides a detailed record of user actions, offering valuable context… Palo Alto Unit 42 · Jun 12, 2026 Medium biomemacosforensics
malware FlutterShell Backdoor Spreads to macOS via Malicious Google and YouTube Ads A new macOS malvertising campaign, dubbed Operation FlutterBridge, is utilizing FlutterShell, a backdoor that spreads adware via malicious Google and YouTube ads. The campaign, traced back to the CL-CRI-1089 threat actor… The Hacker News · Jun 4, 2026 High USCAAUmalvertisingmacoswebview
malware Operation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell Backdoor Palo Alto Unit 42 is tracking ‘Operation FlutterBridge,’ a widespread malvertising campaign targeting macOS users. The campaign, a follow-up to the ‘JSCoreRunner’ campaign, utilizes malicious desktop applications built w… Palo Alto Unit 42 · Jun 2, 2026 High USmacosmalvertisingbackdoor
threat-intel JINX-0164 Targets Cryptocurrency Firms with Fake Recruiter Lures and macOS Malware A previously undocumented threat actor, dubbed JINX-0164, is targeting cryptocurrency firms through sophisticated social engineering tactics and bespoke macOS malware to steal digital assets. The campaign involves luring… The Hacker News · May 28, 2026 High KPmacossocial engineeringcryptocurrency
malware Possible ACR Stealer From Page Impersonating Claude, (Tue, May 26th) This report details the discovery of a fake Claude webpage distributing the ACR Stealer malware, targeting macOS and Windows users. The initial infection vector involves malicious ads leading to the deceptive site, which… SANS Internet Storm Center · May 26, 2026 High USstealermacoswindows
vulnerability How an image could compromise your Mac: understanding an ExifTool vulnerability (CVE-2026-3102) This article details a vulnerability (CVE-2026-3102) in ExifTool for macOS, allowing an attacker to execute arbitrary commands by injecting malicious data into the FileCreateDate metadata field. The vulnerability stems f… Securelist · May 20, 2026 Critical CVE-2026-3102CVE-2021-22204exiftoolmacosmetadata
malware Stealer Spoofs Google, Microsoft & Apple, Then Backdoors macOS A new macOS infostealer, dubbed SHub Reaper, is targeting users through fake WeChat and Miro installers, mimicking Google, Microsoft, and Apple to lure victims. This malware combines stealer and backdoor capabilities, ut… Dark Reading · May 19, 2026 High USmacosinfostealerbackdoor
