Do Son Researcher Mickey Jin uncovers CVE-2025-43530, a critical TCC bypass in macOS allowing attackers to hijack user data via accessibility tools.
macOS
A macOS LPE flaw resurfaces after 7 years, allowing unprivileged users to hijack third-party installers and gain root access. The exploit leverages the hidden .localized directory to confuse the installation path.
A High-severity flaw in macOS PackageKit bypasses a previous fix. Exploiting the user's .zprofile file allows a local attacker to easily gain root privileges.
A new macOS stealer (Nova) uses LaunchAgents to install a modular backdoor. Its main function is replacing legitimate Ledger/Trezor apps with phishing clones that exfiltrate seed phrases as users type.
Microsoft is exploring integrating the open-source Windows Edge Light tool into PowerToys to bring a virtual ring light feature to Windows 11 for better video calls.
macOS Tahoe 26.2 beta reveals "Edge Light," an AI-driven virtual ring light that uses the display edges and Neural Engine to optimize illumination for video calls.
A new macOS threat uses malicious AppleScript (.scpt) files, disguised as documents/updates, to bypass Gatekeeper and execute stealers like MacSync and Odyssey, exploiting user trust.
Apple unveiled a fully featured web-based App Store homepage with search, cross-platform toggles (iOS, macOS, watchOS), and a curated "Today" section.
Kaspersky exposed BlueNoroff's GhostCall/GhostHire campaigns, which use AI-enhanced lures (GPT-4o images) and trojanized apps to target executives and developers, deploying SilentSiphon spyware on macOS.
A High-severity OpenVPN flaw (CVE-2025-10680) in beta versions allows script injection on Unix-like clients (Linux, macOS). Malicious DNS/DHCP arguments can execute arbitrary commands on the client side.
OpenAI acquired Software Applications, the team behind the Mac app Sky, to integrate system-level automation and agentic AI capabilities into ChatGPT.
Apple is poised for a major shift, with the MacBook Pro reportedly getting a Touchscreen OLED display and M6 chip in late 2026. The redesign will also eliminate the notch and retain the keyboard/trackpad.
Meta is discontinuing the Messenger desktop app for macOS/Windows on Dec 15, pushing users to the web/Facebook app. Users must enable Secure Storage to save their chat history.
A malware campaign is spoofing Homebrew installer websites to trick macOS developers. The sites use clipboard injection to hide a malicious payload alongside the install command.
AWS patched a Critical (CVSS 9.3) local flaw (CVE-2025-11462) in its Client VPN for macOS. A non-admin user can gain root privileges via a symlink manipulation attack.
A public PoC has been released for CVE-2025-24085, a zero-day flaw in Apple's Core Media framework that allows a malicious app to elevate its privileges. Update now.
LastPass warns of a new SEO poisoning campaign that uses fake GitHub repos to trick Mac users into downloading Atomic Stealer, a malware that steals data.
A new supply chain attack on PyPI is delivering SilentSync, a Python RAT. The malware steals credentials and files from developers' systems.
Mac Studio M3 Ultra users are reporting failed upgrades to macOS 26.0 Tahoe due to a Neural Engine driver flaw. Users are advised to wait for a fix.
Apple has issued new spyware alerts to French officials, journalists, and activists. These warnings are often tied to highly sophisticated, zero-click attacks.
Apple has released an urgent security update to patch a zero-day vulnerability (CVE-2025-43300) in its Image I/O framework that is being actively exploited in targeted attacks.
A critical flaw (CVE-2025-24103) in macOS InstallAssistant allows a normal user to bypass TCC, exposing private data. A PoC is public, urging users to update to 15.3.