macos

Сообщение ChainCatcher, сотрудник Meta Спенсер Барнетт написал в X, что Meta сегодня запустила приложение Meta AI для Mac OS.

Сообщение от ChainCatcher, согласно подтверждению Национального центра кибербезопасности Нидерландов (NCSC-NL), злоумышленники используют серьезную уязвимость аутентификации CVE-2026-65400 в функции общего доступа к экрану macOS для атак на Mac-устройства, выставленные в интернет. Уязвимость имеет оценку CVSS 9.8, и злоумышленники могут обойти аутентификацию и получить права Root на системе без действительных учетных данных.NCSC-NL сообщает, что получены несколько отчетов о активном использовании, и порт 5900 на затронутых устройствах доступен напрямую из интернета. В подтвержденных случаях злоумышленники успешно получили права Root и развернули программу майнинга Monero (XMR) на зараженных Mac-устройствах. Apple недавно исправила эту уязвимость в macOS Tahoe 26.6.1, Sequoia 15.7.9 и Sonoma 14.8.9. Security Affairs напоминает, что пользователи, включившие общий доступ к экрану и не обновившие систему, должны как можно скорее завершить обновление; если обновление временно невозможно, следует отключить функцию общего доступа к экрану, чтобы избежать выставления порта 5900 в интернет.

Сообщение ChainCatcher, согласно отчету The Hacker News, Национальный центр кибербезопасности Нидерландов (NCSC) предупреждает, что недавно исправленная серьезная уязвимость аутентификации в компоненте общего доступа к экрану macOS от Apple (CVE-2026-65400, оценка CVSS 9.8) была использована в дикой природе, и злоумышленники могут получить доступ к Mac, выставленному в интернет (порт 5900), и установить программу для майнинга Monero без действительных учетных данных.Apple исправила эту уязвимость в экстренном обновлении 6 августа вместе с macOS Tahoe 26.6.1, Sequoia 15.7.9 и Sonoma 14.8.9, улучшив управление состоянием и усилив проверку учетных данных. NCSC подтвердил, что в нескольких атаках злоумышленники получили права root и развернули программное обеспечение для майнинга. Исследователь безопасности @osxreverser раскрыл еще одну предаутентификационную уязвимость в том же компоненте (также исправленную в 26.6), которая позволяет обойти проверку пароля, используя только целевой IP, без необходимости в имени пользователя.По данным компании Calif, исследователи всего за 4 часа разработали два работающих эксплойта для этих уязвимостей с использованием ИИ, что показывает, что ИИ значительно сокращает время от обнаружения уязвимости до разработки кода атаки. Пользователям рекомендуется немедленно обновить систему; если обновление невозможно, следует отключить функцию общего доступа к экрану.

ChainCatcher сообщает, что по данным FinanceFeeds, исследователи безопасности обнаружили вредоносное ПО для кражи информации, нацеленное на устройства macOS, которое атакует пользователей криптовалют. Это ПО может захватывать сессии Telegram Desktop, красть пароли и базы данных кошельков, чтобы получить дальнейший контроль над учетными записями пользователей и украсть цифровые активы. В настоящее время под угрозой находятся такие кошельки и приложения, как Exodus, Atomic, Electrum, Wasabi, Monero и другие программные кошельки.Это вредоносное ПО способно извлекать конфиденциальную информацию из macOS Keychain, Safari Cookie, Apple Notes, Telegram Desktop и нескольких баз данных, связанных с криптовалютными кошельками, включая учетные данные для входа, файлы аутентифицированных сессий, данные кошельков и информацию о расширениях браузера. Безопасный анализ указывает на то, что опасность этой цепочки атак заключается в том, что она не зависит от единственной уязвимости кошелька, а связывает вторжение в устройство, захват учетной записи, взлом кошелька и кражу мнемонических фраз, собирая различные данные на устройстве. При этом сессии Telegram Desktop становятся ключевой целью.Злоумышленники могут копировать аутентифицированные данные локальной сессии Telegram и восстанавливать вход на другом устройстве Mac без необходимости ввода номера телефона, кода подтверждения или пароля двухфакторной аутентификации Telegram. Это означает, что 2FA Telegram не может обеспечить полную защиту в этом сценарии атаки, поскольку злоумышленники не выполняют новый вход, а используют уже доверенную локальную сессию. Для пользователей криптовалюты риск значительно возрастает. Поскольку Telegram широко используется для обслуживания клиентов бирж, сообществ проектов, OTC-торговли и общения с кошельками, как только злоумышленники получают доступ к сессии пользователя, они могут выдавать себя за жертву, читать конфиденциальные чаты, определять информацию об активах и даже распространять вредоносные ссылки среди контактов.

Сообщение ChainCatcher, согласно Cryptopolitan, новый тип вредоносного ПО для macOS под названием Reaper распространяется через фальшивые страницы загрузки приложений, таких как WeChat и Miro, с целью кражи данных криптовалютных кошельков, паролей браузеров и конфиденциальных документов. Это вредоносное ПО использует AppleScript URL для запуска встроенного редактора скриптов системы, скрывая вредоносный код с помощью ASCII-арта и пробелов. После нажатия кнопки запуска поддельное окно обновления безопасности Apple вводит жертву в заблуждение, заставляя ввести пароль от компьютера.Reaper нацелен на настольные крипто-приложения, такие как Ledger Live, Trezor Suite и Exodus, модифицируя внутренний код кошелька для перехвата будущих транзакций и перенаправления средств. В то же время он крадет сохраненные учетные данные из Chrome, Firefox и Edge, извлекая файлы .docx, .pdf, .wallet и другие из рабочего стола и папки документов. Reaper также устанавливает бэкдор, маскирующийся под каталог обновлений программного обеспечения Google, для реализации постоянной атаки. Эксперты по безопасности советуют пользователям проверять ссылки для загрузки, не вводить пароли в неожиданных всплывающих окнах и немедленно закрывать страницу, если сайт требует открыть редактор скриптов.

According to market news, Microsoft's security research team has discovered that attackers have been inducing users to run malicious terminal commands by publishing fake macOS troubleshooting guides since the end of 2025, thereby stealing cryptocurrency wallets, iCloud data, and passwords saved in browsers.These fake guides are published on platforms such as Medium, Craft, and Squarespace, targeting common user issues like freeing up disk space or fixing system errors, and tricking users into copying and pasting malicious commands into the terminal, which automatically downloads and runs malware. This social engineering technique, named ClickFix, bypasses macOS's Gatekeeper security mechanism because the victims are actively executing the commands.The malware families involved include AMOS, Macsync, and SHub Stealer, which can steal cryptocurrency wallet keys from Exodus, Ledger, and Trezor, as well as usernames and passwords saved in Chrome and Firefox. In some cases, attackers also delete legitimate wallet applications and replace them with trojan versions. Apple has added a protective feature in macOS version 26.4 to prevent the pasting of potentially malicious commands.

According to CoinDesk, monitoring by CertiK reveals that the Lazarus Group is conducting an attack operation named Mach-O Man targeting executives in the fintech and cryptocurrency industries. This operation utilizes ClickFix social engineering techniques, sending fake online meeting invitations to lure victims into pasting repair commands on their Mac terminals, thereby gaining access to company and financial systems.CertiK researcher Natalie Newson stated that the Lazarus Group has stolen over $500 million through attacks on Drift and KelpDAO in the past two weeks. Mach-O Man is a modular macOS malware toolkit developed by the Chollima division of the Lazarus Group, capable of automatically deleting itself after use to evade detection.Additionally, attackers have implemented this attack by hijacking DeFi project domain names and replacing them with fake Cloudflare messages.

According to monitoring by the blockchain security firm SlowMist, MistEye has received threat intelligence from the community indicating that a malware named "MacSync Stealer" (v1.1.2) is active and highly destructive. This malware targets macOS users, stealing sensitive data including cryptocurrency wallets, browser credentials, system keychains, and infrastructure keys (SSH/AWS/K8s).The malware uses a spoofed AppleScript system dialog for phishing and displays fake error messages stating "unsupported" after data leakage. It has immediately synchronized this IOC (Indicator of Compromise) to clients. Do not execute unverified macOS scripts and remain highly vigilant against unexpected system password prompts. If an attack is suspected, immediate remediation is required: change all infrastructure credentials (SSH/AWS/K8s), invalidate any exposed keychains, and quickly migrate cryptocurrency assets to a secure wallet.

Bybit's Security Operations Center has discovered a multi-stage malware attack targeting macOS users of the search AI development tool Claude Code.Attackers used search engine optimization poisoning to push malicious domains to the top of Google search results, luring users into a counterfeit installation page, thereby stealing browser credentials, macOS keychain, Telegram sessions, VPN configurations, and cryptocurrency wallet information. Bybit stated that the malware can also establish persistent access through backdoor programs and attempts to target over 250 browser wallet extensions and multiple desktop wallet applications. This malicious infrastructure was identified on March 12, and relevant analysis, mitigation, and detection measures were completed on the same day.

OpenAI stated that during a recent industry-wide security incident, potential security issues were discovered in the third-party development library Axios that they use. After investigation, no evidence was found of user data being accessed, systems being compromised, or software being tampered with.Out of caution, OpenAI has initiated security reinforcement measures, focusing on strengthening the authentication mechanism of the macOS application to prevent malicious parties from distributing counterfeit official applications. OpenAI also reminds all macOS users to update to the latest version of the application as soon as possible, either through in-app updates or official channels, to reduce potential risks.

The Chief Information Security Officer of Slow Fog, 23pds, shared that the MacSync Stealer malware, active on the macOS platform, has shown significant evolution, with user assets already being stolen.The forwarded article mentions that it has upgraded from early low-threshold inducement methods like "dragging to terminal" and "ClickFix" to code signing and notarized Swift applications by Apple, significantly enhancing its concealment. Researchers found that the sample spreads in the form of a disk image named zk-call-messenger-installer-3.9.2-lts.dmg, disguising itself as instant messaging or utility applications to induce users to download. Unlike previous versions, the new version does not require any terminal operations from the user; instead, a built-in Swift helper pulls and executes encoded scripts from a remote server, completing the information theft process.The malware has completed code signing and has been notarized by Apple, with the developer team ID being GNJLS3UYZ4, and the relevant hash has not been revoked by Apple during analysis. This means it has a higher "trustworthiness" under the default macOS security mechanisms, making it easier to bypass user vigilance. The research also found that the DMG is unusually large, containing bait files such as LibreOffice-related PDFs to further reduce suspicion.Security researchers point out that such information-stealing Trojans often target browser data, account credentials, and cryptocurrency wallet information. As malware begins to systematically abuse Apple’s signing and notarization mechanisms, the risks of phishing and private key leakage for cryptocurrency users in the macOS environment are on the rise.

According to 23pds, the Chief Information Security Officer of Slow Fog Technology, a new variant of the information-stealing malware MacSync has emerged, successfully bypassing the macOS Gatekeeper security mechanism, resulting in the theft of user assets.This malware employs various techniques to evade detection, including file inflation, network connection validation, and self-destruct scripts after execution. Attackers can use this software to steal sensitive data from victims, such as iCloud keychains, browser passwords, and cryptocurrency wallets. Users should remain vigilant, avoid downloading software from unknown sources, promptly update operating system security patches, and take additional measures to protect the security of their crypto assets.

ChainCatcher News: Recently, the Cybersecurity Threat and Vulnerability Information Sharing Platform (NVDB) of the Ministry of Industry and Information Technology detected a high-risk out-of-bounds write vulnerability in Apple's iOS/iPadOS/macOS, which has been exploited for cyber attacks.iOS/iPadOS/macOS is an operating system developed by Apple Inc. Due to an out-of-bounds write vulnerability in its ImageIO framework, processing malicious image files may lead to memory corruption.

ChainCatcher news, according to Forbes, security company ESET has just released its latest threat report, which examines the threat landscape trends from June to November 2024. The number of password theft attacks targeting cryptocurrency wallets has increased, with the most significant rise occurring among macOS users.The report states: "According to ESET's telemetry data for the second half of 2024, the number of password-stealing software across multiple platforms (especially Windows, macOS, and Android) has increased," but compared to the first half of the year, the detection of password-stealing software targeting cryptocurrency wallets on macOS has more than doubled. Meanwhile, the number of password-stealing software on the Windows platform grew by 56%, while financial threats on the Android platform, including password-stealing malware, increased by 20%.ESET's analysis shows that the number of password-stealing software targeting the macOS platform (especially those related to cryptocurrency wallet credentials) surged by 127%. Security researchers noted: "Although these threats cannot be simply classified as password-stealing software just because they have broader functionalities, they do reveal a significant upward trend in password theft activities on the macOS platform." From a geographical perspective, ESET's analysis indicates that attacks on Bitcoin and other cryptocurrencies targeting macOS are mostly aimed at the United States, followed by Italy, China, Spain, and Japan.

ChainCatcher message, Slow Mist's Chief Information Security Officer 23pds posted a reminder that recently, the well-known cryptocurrency theft Trojan MacOS Stealer has been suddenly open-sourced.Previously, its attack source code was sold for 1 BTC, and now the open-sourcing means that more malicious attackers can easily access this tool. This not only potentially allows attackers to have "one tool per person" for attacks but may also give rise to more covert and complex attack methods, posing greater challenges to the security of cryptocurrency assets.

ChainCatcher news, according to Forbes, researchers have confirmed that a malware attack targeting macOS users has been active for four months. This attack uses malware disguised as a video conferencing application to steal passwords from Keychain, as well as session cookies and cryptocurrency wallet information from browsers like Google Chrome, Brave, and Opera.According to Tara Gould from Cado Security Labs, the attackers use AI-generated content to create fake websites and social media accounts, posing as trustworthy businesses. Victims are often contacted through platforms like Telegram, discussing business opportunities related to blockchain or cryptocurrency. Once the file is installed, users are prompted to enter their macOS password, further facilitating data theft.Security experts advise users to remain vigilant, especially regarding unfamiliar links related to business. Using protective tools like Intego VirusBarrier can effectively defend against such threats.

According to ChainCatcher news reported by Cointelegraph, North Korean hackers appear to have developed malware that can evade Apple's security checks. Researchers at Jamf Threat Labs, who focus on Apple, indicate that these applications seem to be experimental. This is the first time they have seen such technology used to infiltrate Apple's macOS operating system, but it does not run on the latest systems.Researchers found that Microsoft's VirusTotal online scanning service reported these applications as harmless, but they are actually malicious. Variants of these applications are written in Go and Python, utilizing Google Flutter applications. Flutter is an open-source development toolkit used for creating cross-platform applications.Out of six malicious applications, five are signed with developer accounts and have been temporarily notarized by Apple. Researchers wrote, "The domains and techniques in the malware are very similar to those used in other North Korean hacker malware, with indications that the malware was once signed and even temporarily passed Apple's notarization process."

ChainCatcher news, according to IT Home, developer Pedro Vieito posted an update on the Thread platform 2 days ago, stating that the macOS version of the ChatGPT app stores user conversations in plain text. OpenAI responded today that it has updated its app and encrypted the chat logs stored on Mac devices.According to Vieito's analysis, since conversations are stored in plain text outside the sandbox, this also means that conversations can be accessed by other applications, processes, or even malware running on the Mac without the user's knowledge.

ChainCatcher news, according to OpenAI's announcement, the ChatGPT desktop application is now available for all macOS users. Users can quickly access ChatGPT using the shortcut Option + Space, making it easier to chat, handle emails, take screenshots, and manage other content on the screen.In addition, OpenAI has launched a new feature that allows users to search through past conversation history. Users can also quickly and easily query any information on their computers.

ChainCatcher message, Kaspersky Labs has discovered new malware entering macOS users' computers through pirated applications, stealing users' cryptocurrency wallets. This malware targets macOS versions 13.6 and above, allowing hackers to access the user's computer security password when the user inputs their computer security password into the activator box; when the user attempts to open the cryptocurrency wallet compromised by the malware, hackers can access the private keys of the cryptocurrency wallet.Kaspersky Labs reminds cryptocurrency users that they can avoid the ongoing malware activities by using trusted websites, keeping their computer operating systems updated, and employing security solutions.