#macOS
All CosmicBytez Labs articles tagged #macOS, across news, security advisories, how-to guides, and projects.
- News
Google Gemini Could Soon Get Full Access to Your Mac's Files, Apps, and the Web
A hidden setting in Gemini's macOS app could let the AI read, edit, and delete any file, control native apps, and browse the web without asking first.
- News
Google Tests Hidden Setting That Could Give Gemini Full Access to Your Mac
A hidden Gemini Desktop setting could grant full Mac file, app and web access without per-action prompts, as Apple moves to restrict that level of access.
- News
Apple Patches Meta-Reported Zero-Day Tied to 'Extremely Sophisticated' Attack
Apple fixed CVE-2026-86950, a CoreGraphics flaw reported by Meta and used against targeted individuals, via iOS, iPadOS, and macOS updates.
- News
PamStealer's Third Variant Adds Live C2 Payload Decryption and Four-Layer Persistence
Jamf Threat Labs found a third PamStealer variant tying payload decryption to a live X25519 exchange with its C2 server and four persistence layers.
- News
MacSync Malware Uses Public iCloud Calendars to Deliver New Payloads
Kaspersky: MacSync's downloader now hides commands in public iCloud calendar event descriptions and adds a Finder-spoofing backdoor module.
- News
Hidden Meta Muse Setting Lets Local Malware Turn the AI Assistant Into a Backdoor
Researcher Patrick Wardle shows how malware already on a Mac can quietly redirect Muse's mic feed and hijack its granted permissions.
- News
Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors
North Korea's Jade Sleet compromised an Indian IT firm's DevOps engineer via a fake job-interview repo, deploying two new Rust macOS backdoors.
- News
Hackers Hijack HBO Max Reddit Account to Push ClickFix Malware Ads
Attackers took over HBO Max's verified Reddit account, running 108 malicious ads over 48 hours that used ClickFix lures to infect Windows...
- News
Homebrew 7.0.0 Gets Built-In GUI, Better Security Controls
Homebrew 7.0.0 ships a native GUI (BrewUI), a built-in brew vulns scanner, and Landlock sandboxing in its biggest security release yet.
- News
Hackers Exploit macOS Screen Sharing Flaw to Deploy Monero Miner
Netherlands NCSC warns hackers are actively exploiting a macOS authentication bypass in Screen Sharing after public exploit code emerged, deploying Monero...
- Security
CVE-2026-28911: macOS Critical Memory Corruption via Malicious App
A critical memory corruption vulnerability in macOS allows a malicious application to corrupt memory of a system process. Apple patched the flaw in macOS...
- Security
CVE-2026-28928: Apple Platform Use-After-Free Causes Unexpected System Termination
A critical use-after-free vulnerability affects iOS, iPadOS, macOS, tvOS, and watchOS. A malicious app can trigger unexpected system termination. Apple...
- Security
CVE-2026-28982: macOS Race Condition Allows Remote Kernel Memory Corruption
A critical race condition in macOS enables a remote attacker to cause unexpected system termination or corrupt kernel memory. Apple patched the flaw in...
- News
New ClickLock macOS Malware Traps Users Into Revealing Login Password
Group-IB researchers uncovered ClickLock, a macOS infostealer that runs a 210ms kill loop for up to 83 hours to coerce victims into entering their...
- News
In Other News: Iran Tracks US Military Phones, CrashStealer macOS Malware, CVD Blueprint
This week's security roundup covers Iranian threat actors tracking US military personnel's phones, the newly discovered CrashStealer macOS infostealer, a...
- News
ClickLock: New macOS Infostealer Kills Apps Every 210ms to Force Password Entry
Group-IB researchers discovered ClickLock, a new macOS infostealer distributed via ClickFix lures that terminates all visible system processes in a loop...
- News
ClickLock: New macOS Stealer Kills Every App Until You Type Your Password
Group-IB researchers discovered ClickLock, a macOS infostealer that uses ClickFix social engineering to install a kill loop firing pkill every 210ms —...
- News
PamStealer Uses Fake Maccy Sites and PAM Checks to Steal Mac Login Passwords
Jamf Threat Labs has discovered PamStealer, a sophisticated two-stage macOS infostealer that impersonates the Maccy clipboard manager, delivers a...
- News
AI-Generated Browser Ransomware Abuses Chromium API on Windows, Linux, macOS, Android
Researchers have uncovered a novel malware artifact generated using DeepSeek that weaponizes the Chromium File System Access API to encrypt files entirely...
- Security
CVE-2026-46735: Dell DDPM Mac OS Command Injection Allows Local Privilege Escalation
A high-severity OS command injection flaw in Dell Display and Peripheral Manager for macOS (versions prior to 2.3) allows low-privileged local attackers...
- News
Weekly Recap: Chrome 0-Day, UniFi Exploits, macOS Stealers, VPN Flaw and More
This week's security roundup covers an actively exploited Chrome zero-day, attackers abusing UniFi network controllers, fresh macOS infostealer campaigns,...
- News
OpenAI Asks macOS Users to Update After TanStack npm Supply
OpenAI is urging macOS users to update their software following an expanding supply chain attack that compromised TanStack and additional npm and PyPI...
- News
Hackers Abuse Google Ads and Claude.ai Chats to Push Mac
Attackers are running a sophisticated malvertising campaign that hijacks Google Ads and legitimate Claude.ai shared chat sessions to deliver Mac malware...
- Security
CVE-2026-41500: electerm macOS Command Injection via Install Script
A critical command injection vulnerability in the electerm terminal client allows remote attackers to achieve unauthenticated code execution on macOS...
- News
ThreatsDay Bulletin: $290M DeFi Hack, macOS LotL Abuse
This week's ThreatsDay Bulletin covers the $290M KelpDAO DeFi hack tied to Lazarus Group, new macOS living-off-the-land attack techniques, ProxySmart SIM...
- News
In Other News: ChatGPT Data Leak, Android Rootkit, Water
This week's security stories you may have missed: a ChatGPT conversation data leak, a new Android rootkit on Google Play, a municipal water facility taken...
- News
Cloudflare-Themed ClickFix Attack Drops Infiniti Stealer on Macs
A newly observed ClickFix campaign impersonates Cloudflare's CAPTCHA verification pages to deliver the Python-based Infiniti Stealer to macOS users via a...
- News
New Infinity Stealer Malware Grabs macOS Data via ClickFix
A new info-stealing malware named Infinity Stealer is targeting macOS systems with a Python payload packaged as an executable using the open-source Nuitka...
- Security
CVE-2025-43510: Apple Multiple Products Improper Locking
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability allowing a malicious app to cause unexpected changes in...
- News
Russian APT 'ChainReaver' Hijacks 50 GitHub Accounts and Mirrors
A Russian state-sponsored APT group dubbed ChainReaver-L compromised trusted file-sharing mirrors and 50 long-established GitHub accounts to distribute...
- News
Claude AI Artifacts Abused to Distribute macOS Infostealer
Threat actors are abusing publicly shared Claude AI artifacts and Google Ads to deliver the MacSync infostealer to macOS users through ClickFix social...
- Security
Apple Patches Actively Exploited Zero-Day in dyld
Apple releases emergency patches across all platforms for a memory corruption vulnerability in the Dynamic Link Editor (dyld) that was exploited in...
- News
Apple Releases Critical Security Updates Across All
Apple has released security updates for iOS, macOS, watchOS, and tvOS addressing multiple actively exploited vulnerabilities. Users urged to update immediately.