https://cybersecuritytracker.ai/?stack=1Stories and vulnerabilities involving Apple.Sun, 26 Jul 2026 22:32:51 GMThttps://elastic.co/security-labs/agentic-soc-token-budget-architecturecst-3189Elastic InfoSec compares two architectural approaches for agentic security operations centers: a single agent with a library of skills versus a fleet of specialized agents orchestrated through deterministic workflows. Testing on 36,822 real production investigations shows the specialized agent approach costs $0.69 per alert triage versus $3.42 for the single-agent method, a 5.7x difference at scale. The choice between architectures depends on investigation patterns, team maturity, and whether analysts need flexible on-demand skill loading or deterministic methodologies.Fri, 24 Jul 2026 00:00:00 GMThttps://thehackernews.com/2026/07/claude-cowork-flaw-could-let-ai-agent.htmlcst-3104Researchers discovered a sandbox escape vulnerability in Anthropic's Claude Cowork that allows an AI agent to break out of its Linux VM and access files on the host macOS system. The flaw potentially affects approximately 500,000 macOS users running the software.Thu, 23 Jul 2026 13:27:59 GMThttps://thehackernews.com/2026/07/apple-fixes-hide-my-email-bug-that.htmlcst-2963Apple patched a vulnerability in its Hide My Email service that allowed real email addresses to be exposed in mail logs, bypassing the privacy feature's core function. The issue was discovered by a security researcher and disclosed to Apple over a year before the fix was deployed on July 3, 2026.Tue, 21 Jul 2026 18:46:32 GMThttps://isc.sans.edu/diary/rss/33172cst-2928This article explains how modern operating systems and browsers detect captive portals on public WiFi networks by attempting to access specific HTTP URLs and checking for redirect responses. Different platforms use different detection URLs: Windows checks msftconnecttest.com, Apple uses captive.apple.com, Android and Chrome use generate_204 endpoints, and Firefox uses detectportal.firefox.com. Understanding these detection mechanisms can help network administrators and security analysts recognize benign traffic patterns and assist users who encounter connectivity issues.Tue, 21 Jul 2026 13:44:56 GMThttps://helpnetsecurity.com/2026/07/20/product-showcase-zonealarm-mobile-security-adds-customizable-content-filtering-to-mobile-securitycst-2812Check Point released ZoneAlarm Mobile Security, a mobile protection app that defends against phishing, malicious websites, and fraudulent links across iOS, Android, and Apple silicon Macs. The application features customizable content filtering and a Safari extension that checks websites before loading.Mon, 20 Jul 2026 04:30:34 GMThttps://securityweek.com/in-other-news-iran-tracks-us-military-phones-crashstealer-macos-malware-cvd-blueprintcst-2768A roundup of security news includes OpenClaw artificial intelligence (AI) agents being exploited through WhatsApp, ransomware targeting naval defense contractor TKMS, and a data breach disclosure from Lidl. Additionally, reports cover Iranian tracking of US military phones, CrashStealer malware affecting macOS systems, and developments in coordinated vulnerability disclosure (CVD) practices.Fri, 17 Jul 2026 14:27:54 GMThttps://helpnetsecurity.com/2026/07/17/apple-facetime-calls-scamscst-2747Apple is warning users that scammers exploit FaceTime to conduct social engineering attacks, impersonating representatives of trusted organizations to extract login credentials, security codes, and financial information. Attackers use caller ID spoofing to mask their identity, making it difficult for victims to verify legitimacy.Fri, 17 Jul 2026 10:02:21 GMThttps://wired.com/story/san-francisco-demands-apple-and-google-delete-ai-nudify-apps-from-app-storescst-2750San Francisco's City Attorney sent cease-and-desist letters to Apple and Google demanding they remove 13 face-swap applications from their app stores. The apps are designed to generate non-consensual intimate imagery targeting women and girls, generating revenue for the platforms hosting them.Fri, 17 Jul 2026 10:00:00 GMThttps://helpnetsecurity.com/2026/07/17/1password-anthropic-claude-integrationcst-27481Password has released a beta integration for Claude that allows the AI assistant to complete authentication-required browser tasks while keeping user passwords and secrets protected. The feature is available to paid Claude subscribers using Claude Desktop on macOS and compatible with 1Password individual, family, and business plan customers. The integration requires specific software components including Claude Desktop, the 1Password desktop app, and browser extension.Fri, 17 Jul 2026 09:17:44 GMThttps://securityweek.com/clicklock-stealer-bypasses-macos-security-with-social-engineering-process-killingcst-2679A macOS malware called ClickLock Stealer has targeted at least 100 users by combining social engineering tactics with process killing techniques to bypass security protections and steal passwords and cryptocurrency. The attack method exploits user interaction to circumvent macOS defenses.Thu, 16 Jul 2026 12:43:59 GMThttps://thehackernews.com/2026/07/new-clicklock-macos-stealer-kills-apps.htmlcst-2671ClickLock Stealer is a new macOS infostealer that arrives via a Terminal command and displays a fake system dialog requesting the user's login password. When users decline, the malware installs LaunchAgents that repeatedly terminate core system applications like Finder, Dock, and Spotlight every 210 milliseconds until the victim relents and provides their credentials.Thu, 16 Jul 2026 12:33:42 GMThttps://recordedfuture.com/research/iran-ai-asymmetric-playbookcst-2691Between January and June 2026, Iran leveraged artificial intelligence to enhance its asymmetric warfare capabilities across cyber operations, information warfare, propaganda production, and domestic surveillance during military and political crises. AI functioned as a force multiplier that increased the speed, scale, and effectiveness of Iranian operations, particularly in information campaigns and cyber attacks, though its direct impact on battlefield tactics remains unconfirmed. Iran's hybrid approach, augmented by partnerships with Russia and China for military and surveillance technologies, demonstrates how AI amplifies existing capabilities rather than creating fundamentally new ones.Thu, 16 Jul 2026 00:00:00 GMThttps://helpnetsecurity.com/2026/07/15/clickfix-social-engineering-attacks-reportcst-2586ClickFix, a social engineering technique that emerged in late 2023, has evolved into an industrialized attack ecosystem that bypasses traditional antivirus and endpoint defenses by tricking users into executing malicious commands via fake error pages styled as CAPTCHA checks or browser updates. The method avoids exploits and vulnerabilities altogether, instead relying on social manipulation to compromise systems. Security researchers at ReversingLabs report that this approach is outpacing conventional defense mechanisms.Wed, 15 Jul 2026 10:44:03 GMThttps://bleepingcomputer.com/news/security/nearly-300-github-repos-pose-as-legit-software-to-push-malwarecst-2512A threat actor created hundreds of fake GitHub repositories that impersonate legitimate software and security projects to distribute infostealer malware. These repositories are designed to deceive developers searching for authentic tools and libraries.Tue, 14 Jul 2026 19:15:17 GMThttps://techcrunch.com/2026/07/13/apple-says-former-employee-exploited-rare-bug-to-download-confidential-files-after-leaving-for-openaicst-2449Apple says a former employee who departed for OpenAI exploited a rare bug to download confidential files from Apple's network after leaving the company. Apple declined to comment further on the incident.Mon, 13 Jul 2026 20:00:17 GMThttps://bleepingcomputer.com/news/security/new-crashstealer-malware-poses-as-apple-crash-reporting-toolcst-2431CrashStealer is a new macOS information stealer that masquerades as Apple's crash-reporting tool to harvest credentials, keychain data, and cryptocurrency wallet information. The malware achieves persistence through social engineering by disguising itself as a legitimate system component.Mon, 13 Jul 2026 19:04:02 GMThttps://thehackernews.com/2026/07/compromised-jscrambler-8140-npm-release.htmlcst-2367Version 8.14.0 of the jscrambler npm package contained a malicious preinstall hook that silently deployed a Rust-based infostealer on Windows, macOS, and Linux systems during installation. The package required no manual import or command line invocation to execute the malware. Socket security detected the compromised release approximately six minutes after its publication on July 11, 2026.Sat, 11 Jul 2026 17:59:26 GMThttps://rapid7.com/blog/post/pt-weekly-metasploit-update-exploits-for-flowiseai-csv-agent-and-macos-package-kitcst-2357Metasploit released new exploit modules for three vulnerabilities: FlowiseAI CSV Agent (CVE-2026-41264), an unauthenticated remote code execution flaw allowing attackers to upload malicious CSV files; macOS PackageKit (CVE-2024-27822), a privilege escalation vulnerability in ZSH environment handling; and Apache .htaccess persistence for Linux systems. The update also includes enhancements to FTP fingerprinting, library reloading, MCP Server tools, and certificate tracing functionality.Sat, 11 Jul 2026 00:32:34 GMThttps://risky.biz/risky-bulletin-india-bans-app-used-to-hack-e-rickshaws-in-viral-videoscst-2299The Indian government ordered Apple and Google to remove a battery management app that was weaponized to remotely disable electric rickshaws in a viral social media trend called the Tirri Challenge. Videos documented the attacks, which stranded drivers and caused traffic disruptions across the country over a two to three week period.Fri, 10 Jul 2026 03:53:46 GMThttps://helpnetsecurity.com/2026/07/09/product-showcase-mcafee-mobile-security-ioscst-2219McAfee Mobile Security for iOS offers scam protection, web protection, VPN, Wi-Fi security, and device security checks in one app, with availability on Android as well. The app provides an onboarding process, notification options, and Smart Scan functionality that checks device configuration and Wi-Fi network status.Thu, 09 Jul 2026 05:00:52 GMThttps://helpnetsecurity.com/2026/07/08/macos-ai-agents-automationcst-2132macOS is increasingly being used as a testing platform for AI agents capable of autonomous task execution, with examples including agents that can perform multi-application workflows without direct human supervision. These agents demonstrate the ability to operate across system interfaces like Terminal and Safari to complete routine tasks that would normally require manual user intervention.Wed, 08 Jul 2026 05:00:59 GMThttps://isc.sans.edu/diary/rss/33128cst-2083DNS resource record type 32 (NIMLOC) is historically assigned to obsolete protocols but continues to appear in network logs, particularly from macOS systems broadcasting NetBIOS name announcements on port 137. The record type was originally designated for Nimrod routing architecture but is now primarily associated with legacy NetBIOS traffic, a protocol largely replaced by modern DNS and SMB implementations on contemporary networks.Tue, 07 Jul 2026 18:09:04 GMThttps://techcrunch.com/2026/07/07/savis-app-aims-to-protect-consumers-from-realistic-ai-scams-like-kidnappers-demanding-ransomcst-531Savi, a startup focused on protecting consumers from AI-generated scams such as deepfake kidnapping extortion, has raised $7 million in seed funding and is launching its mobile app for iPhone and Android.Tue, 07 Jul 2026 12:00:00 GMThttps://helpnetsecurity.com/2026/07/07/apple-container-open-source-linux-maccst-505Apple has released an open-source container tool called Container that runs Linux containers as lightweight virtual machines on Apple silicon Macs. The tool is written in Swift, optimized for Apple hardware, and supports OCI-compatible images from standard registries.Tue, 07 Jul 2026 05:00:58 GMThttps://isc.sans.edu/diary/rss/33124cst-156RCS (Rich Communication Services) is increasingly used on modern iOS and Android devices as a potential replacement for SMS, featuring optional end-to-end encryption and digital signing. The article explains how NAPTR (Naming Authority Pointer) DNS records, defined in RFC 2915, are being used to locate RCS servers by enabling clients to discover SIP-based service endpoints rather than just IP addresses.Mon, 06 Jul 2026 13:35:58 GMThttps://thehackernews.com/2026/07/new-java-based-quimarat-maas-built-to.htmlcst-20Researchers have identified QuimaRAT, a Java-based remote access trojan (RAT) marketed as a malware-as-a-service (MaaS) offering that targets Windows, Linux, and macOS. The malware is sold through subscription tiers ranging from $150 per month to $1,200 for lifetime access.Mon, 06 Jul 2026 08:13:33 GMThttps://helpnetsecurity.com/2026/07/06/product-showcase-malwarebytes-mobile-security-ioscst-153Malwarebytes Mobile Security for iPhone offers scam prevention, privacy protection, and identity monitoring across multiple platforms including Windows, macOS, Android, iOS, and ChromeOS. The app evaluates device security posture and provides recommendations for improvement through features such as Web Protection, Call Protection, Scam Guard, and a VPN.Mon, 06 Jul 2026 05:00:44 GMThttps://wired.com/story/security-roundup-apples-hide-my-email-service-fails-to-hide-your-emailcst-443Apple's Hide My Email service failed to properly mask user email addresses in certain scenarios. The roundup also covers the extradition of an alleged Scattered Spider member, multiple errors in license plate reader systems, and Indian regulatory concerns about WhatsApp's username feature rollout.Sat, 04 Jul 2026 10:30:00 GMThttps://thehackernews.com/2026/07/pamstealer-uses-fake-maccy-sites-and.htmlcst-31Security researchers identified PamStealer, a macOS information stealer distributed as a compiled AppleScript file masquerading as Maccy, a legitimate clipboard manager. The malware uses deceptive techniques to trick users into installation and extract sensitive data from infected systems.Fri, 03 Jul 2026 08:03:37 GMThttps://arstechnica.com/security/2026/07/new-pamstealer-macos-malware-uses-clever-tradecraft-to-remain-stealthycst-422Researchers discovered PamStealer, a previously unknown macOS malware distributed as a fake Maccy clipboard manager through a disk image containing malicious AppleScript. The malware uses a two-stage delivery mechanism and is written in Rust, leveraging macOS Pluggable Authentication Modules (PAM) interface to intercept and exfiltrate login credentials to attacker-controlled servers.Thu, 02 Jul 2026 19:38:57 GMThttps://darkreading.com/cybersecurity-operations/apple-patch-policy-aicst-77Apple is accelerating its patching cycles in response to attackers using artificial intelligence to develop exploits more quickly. The shift represents a departure from Apple's historical approach to software updates.Thu, 02 Jul 2026 19:31:58 GMThttps://thehackernews.com/2026/07/threatsday-ai-compute-hijacking-apple.htmlcst-34This week's security news covers multiple vulnerability categories spanning browsers, bots, sandboxes, AI systems, and email infrastructure, with a common theme of small permission gaps and weak validation checks rather than dramatic exploits. The incidents demonstrate how attackers leverage incremental weaknesses and normal system behaviors that fall outside security assumptions. Common exposure patterns include insufficient access controls, inadequate verification mechanisms, and overly permissive system configurations.Thu, 02 Jul 2026 15:24:18 GMThttps://thehackernews.com/2026/07/ai-generated-browser-ransomware-abuses.htmlcst-49Researchers discovered ransomware generated by DeepSeek that exploits Chromium APIs to execute a ransomware attack directly within the browser on Windows, Linux, macOS, and Android platforms. The malware combines novel attack concepts with legitimate browser capabilities to operate entirely in the browser environment. This represents the first documented case of a frontier AI model being used to generate functional ransomware code.Wed, 01 Jul 2026 12:59:19 GMThttps://research.checkpoint.com/2026/browser-only-ransomware-from-llm-hallucinations-to-a-practical-attack-techniquecst-595Researchers demonstrated a practical ransomware attack that operates entirely within a web browser on Android devices using the File System Access API, bypassing traditional malware defenses. The attack leverages social engineering through a fake image-enhancement workflow to trick users into granting file system permissions, enabling attackers to encrypt photos and other files. The research highlights how large language models like DeepSeek, with lower refusal rates for harmful requests than competitors, can convert malicious concepts into working attack code more easily than other AI platforms.Wed, 01 Jul 2026 10:05:35 GMThttps://recordedfuture.com/research/nexus-tag182-disseminates-markiratcst-1941Insikt Group identified new infrastructure used by TAG-182, an Iran-linked threat cluster, to distribute MarkiRAT malware through fake Android applications disguised as VPNs and media tools targeting Iranians both domestically and abroad. The malware samples share technical similarities with previously attributed Ferocious Kitten activity, suggesting a possible operational connection. Following Iran's internet restoration in May 2026, surveillance operations using these tools are expected to intensify as Iranian authorities seek to monitor perceived dissidents.Wed, 01 Jul 2026 00:00:00 GMThttps://microsoft.com/en-us/security/blog/2026/06/30/whats-new-in-microsoft-security-june-2026cst-326Microsoft announced security updates for June 2026 including MDASH, a multi-model AI scanning system for discovering and remediating vulnerabilities, extended endpoint protection for local AI agents, and new capabilities for identity backup and recovery. Additional releases include database threat protection for open-source AWS RDS instances and customizable reporting features in Microsoft Purview for data security posture management.Tue, 30 Jun 2026 16:00:00 GMThttps://thehackernews.com/2026/06/282-ios-apps-found-leaking-llm-api-keys.htmlcst-62A study of 444 AI chatbot applications on iOS found that 282 apps exposed API keys and backend authentication tokens in plaintext network traffic, allowing attackers to intercept credentials and make requests on the developer's account without authorization.Tue, 30 Jun 2026 13:49:34 GMThttps://isc.sans.edu/diary/rss/33114cst-159Apple released security updates for iOS, iPadOS, macOS, and Safari on June 30, 2026, addressing 26 vulnerabilities. The majority of issues affect web browsing components including WebKit, libxslt, WebRTC, and Web Extensions, with four vulnerabilities impacting the kernel and GPU family drivers. None of the CVEs are currently marked as exploited in the wild.Tue, 30 Jun 2026 09:31:27 GMThttps://thehackernews.com/2026/06/airdrop-and-quick-share-flaws-let.htmlcst-65Researchers discovered six security vulnerabilities in Apple's AirDrop and Google's Quick Share features that allow nearby attackers to crash the sharing services and bypass security checks without any interaction from the target user. An attacker within wireless range can exploit these flaws on Mac, iPhone, and devices running Quick Share simply by having basic equipment like a laptop, with no prior connection or authentication required.Tue, 30 Jun 2026 09:27:58 GMThttps://reliaquest.com/blog/threat-spotlight-whats-trending-top-cyber-attacker-techniques-march-may-2026cst-2120A threat report covering March through May 2026 finds that ClickFix (a social engineering delivery technique) has become the dominant initial access method, driving 14.9% of spearphishing attacks and nearly 28% of defense-evasion activity while reaching macOS for the first time. The malware leaderboard underwent near-complete turnover for a second consecutive period, with defenders advised to focus on attacker behavior patterns rather than malware family names. Ransomware operators like Qilin continue exploiting unpatched internet-facing firewalls and VPNs using a consistent playbook.Tue, 30 Jun 2026 09:00:00 GMThttps://microsoft.com/en-us/security/blog/2026/06/25/microsoft-a-leader-in-the-forrester-wave-for-endpoint-management-platformscst-330Microsoft Intune has been recognized as a Leader in Forrester's Q2 2026 Endpoint Management Platforms report, reflecting its integration of identity, security, compliance, and AI governance across multiple platforms and device types. The platform consolidates Windows, macOS, iOS, and Android management in a single console and incorporates AI-powered capabilities such as Endpoint Privilege Management, Security Copilot, and a Vulnerability Remediation Agent to assist administrators with policy enforcement and threat response. Forrester also highlighted Microsoft's partner strategy and bundled licensing model as competitive advantages.Thu, 25 Jun 2026 16:00:00 GMThttps://techcrunch.com/2026/06/25/cellebrite-said-it-cut-off-russia-but-russia-used-is-tools-anywaycst-469Security researchers discovered that Russian authorities used a Cellebrite phone-unlocking device to access an iPhone belonging to a political opponent, despite Cellebrite's stated decision to cease business with Russia. The finding suggests the company's export controls or enforcement mechanisms may be insufficient to prevent continued access to its tools by sanctioned actors.Thu, 25 Jun 2026 10:00:00 GMThttps://darkreading.com/application-security/apple-macos-security-gap-users-disable-security-toolscst-115A vulnerability in Apple's macOS allows attackers to disable built-in security and browser tools without requiring administrator privileges or kernel exploits. This represents a gap in the operating system's security architecture that could be leveraged for malicious purposes.Wed, 24 Jun 2026 12:00:00 GMThttps://sentinelone.com/labs/macos-gaslight-rust-backdoor-turns-prompt-injection-on-the-analyst-not-the-sandboxcst-602SentinelLabs has identified macOS.Gaslight, a Rust-based macOS implant attributed to North Korean threat actors that uses Telegram Bot API for command-and-control communications. The implant's notable capability is an embedded payload of fabricated system messages designed to deceive LLM-assisted security analysis tools into aborting their analysis. Communications are hardened with AES-GCM encryption, certificate pinning, and the implant self-redacts sensitive tokens from its runtime output.Tue, 23 Jun 2026 21:59:42 GMThttps://techcrunch.com/2026/06/22/tata-electronics-a-major-tech-supplier-to-apple-and-tesla-confirms-data-breachcst-473Tata Electronics, a significant supplier to Apple and Tesla, has confirmed a data breach. The breach occurs during a period of expansion for the company in global technology supply chains.Mon, 22 Jun 2026 19:25:00 GMThttps://techcrunch.com/2026/06/22/a-new-unpatchable-flaw-in-apple-chips-opens-the-door-to-an-iphone-jailbreakcst-474Paradigm Shift, a European offensive cybersecurity firm, disclosed an unpatchable flaw in Apple chips that enables exploitation techniques for compromising older iPhones. The vulnerability presents a persistent attack vector that cannot be remediated through traditional patching mechanisms.Mon, 22 Jun 2026 18:50:24 GMThttps://wired.com/story/security-news-this-week-hackers-claim-to-leak-stolen-madison-square-garden-datacst-455Hackers claim to have leaked stolen data from Madison Square Garden. The article also covers developments including face scanner use at San Francisco gay bars, France's decision to discontinue Palantir services, and Apple's plans to modify its private email service.Sat, 20 Jun 2026 09:30:00 GMThttps://arstechnica.com/apple/2026/06/apple-patches-high-severity-eavesdropping-vulnerability-in-beats-studio-budscst-430Apple released a firmware update (1B211) for Beats Studio Buds to address CVE-2025-20701, a high-severity vulnerability in Bluetooth authentication that allowed nearby attackers to impersonate paired devices and eavesdrop on user conversations. The vulnerability affected the firmware on Bluetooth-related chips and has been patched through automatic updates delivered when headphones are connected to Apple devices.Thu, 18 Jun 2026 19:41:35 GMThttps://research.checkpoint.com/2026/from-stars-to-upvotes-fake-reputation-fueling-a-crypto-clipboard-hijackercst-596A threat actor is distributing a Rust-based clipboard hijacker disguised as cryptocurrency trading bots and game prediction tools across multiple platforms, including fake GitHub and SourceForge repositories, a YouTube channel with AI-generated content, and compromised news sites. The operation uses coordinated fake accounts, inflated engagement metrics, and manipulated VirusTotal reputation signals to create a false appearance of legitimacy and trustworthiness. Once installed, the malware monitors the clipboard for cryptocurrency wallet addresses and replaces them with attacker-controlled addresses, generating illicit cryptocurrency transactions.Wed, 17 Jun 2026 13:38:55 GMThttps://unit42.paloaltonetworks.com/new-macos-artifact-discoveredcst-341Unit 42 has identified a new forensic artifact in macOS Tahoe 26 that records user menu selections across the operating system. This discovery expands the range of digital artifacts available for forensic analysis and investigation on Apple's latest platform.Fri, 12 Jun 2026 22:00:14 GMT