macos

Apple announced the launch of the new 14-inch MacBook Pro equipped with M6 on October 27 in Cupertino, aimed at students, business users, and creators. The M6 features a 12-core CPU, a 12-core GPU with Neural Accelerators per core, and a dual 16-core Neural Engine, along with faster unified memory. The standard unified memory is 16GB, upgradeable to 32GB, with a memory bandwidth of up to 170GB/s.Apple stated that compared to M5, graphics performance is improved by about 30%, and edge AI workloads are enhanced by about 25%; compared to M1, graphics performance is up to 11 times better, and AI performance is up to 13 times better. Battery life is up to 24 hours, and with a higher power USB-C power adapter (such as 96W), it can charge to 50% in about 30 minutes. The new model supports Wi-Fi 7 and Bluetooth 6, can connect to up to two external displays, and includes ports such as HDMI, MagSafe 3, three Thunderbolt 4 ports, an SDXC card slot, and a headphone jack.The display is a Liquid Retina XDR, with a peak HDR brightness of up to 1600 nits, a contrast ratio of 1,000,000:1, and optional nano-texture glass, with a casing made of 100% recycled aluminum. The new model comes pre-installed with macOS 27 (Golden Gate) and supports Siri AI and Apple Intelligence. In the United States, it starts at $1999, with educational discounts starting at $1899; pre-orders will be open from October 28 in 35 countries and regions, including the United States, with availability and sales starting on November 6. Vice President of Hardware Engineering Shelly Goldberg stated: M6 enhances CPU, graphics, and edge AI performance.

Meta related personnel Spencer Barnett posted on X that Meta has launched the Meta AI Mac OS application today.

According to the Netherlands National Cyber Security Centre (NCSC-NL), attackers are exploiting a serious authentication vulnerability CVE-2026-65400 in the macOS screen sharing feature to target Mac devices exposed to the internet. The vulnerability has a CVSS score of 9.8, allowing attackers to bypass authentication and gain system root access without valid credentials.NCSC-NL stated that multiple reports of active exploitation have been received, with the affected devices' port 5900 being directly accessible from the internet. In the currently confirmed cases, attackers have successfully obtained root access and deployed Monero (XMR) mining programs on the infected Mac devices. Apple has recently patched the vulnerability through macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. Security Affairs reminds users who have screen sharing enabled and have not yet updated their systems to complete the upgrade as soon as possible; if updating is temporarily not possible, they should disable the screen sharing feature to avoid exposing port 5900 to the internet.

According to The Hacker News, the Netherlands National Cyber Security Centre (NCSC) has warned that a recently patched severe authentication vulnerability (CVE-2026-65400, CVSS score 9.8) in Apple's macOS screen sharing component has been exploited in the wild, allowing attackers to access Macs exposed to the internet (port 5900) and implant Monero mining software without valid credentials.Apple has fixed the vulnerability with an emergency update on August 6, alongside macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, by enhancing credential verification through improved state management. The NCSC confirmed that in multiple attacks, the attackers gained root access and deployed mining software. Security researcher @osxreverser disclosed another pre-authentication vulnerability in the same component (also patched in 26.6), which allows bypassing password authentication with just the target IP, without needing a username.According to Calif, researchers developed usable attack programs for both vulnerabilities using AI in just 4 hours, demonstrating that AI is significantly shortening the time from vulnerability discovery to the development of attack code. Users are advised to update their systems immediately; if unable to update, they should disable the screen sharing feature.

According to FinanceFeeds, security researchers have discovered an information-stealing malware targeting macOS devices that is attacking cryptocurrency users. This malware can hijack Telegram Desktop sessions, steal passwords and wallet databases, further controlling user accounts and stealing digital assets. Currently affected wallets and applications include software wallets like Exodus, Atomic, Electrum, Wasabi, and Monero.The malware is capable of extracting sensitive information from macOS Keychain, Safari Cookies, Apple Notes, Telegram Desktop, and multiple cryptocurrency wallet-related databases, including login credentials, authenticated session files, wallet data, and browser extension information. Security analysis points out that the danger of this attack chain lies in its reliance not on a single wallet vulnerability, but on collecting various types of data from the device, linking device intrusion, account takeover, wallet cracking, and mnemonic phrase theft together. Among these, Telegram Desktop sessions have become a key target.Attackers can copy authenticated Telegram local session data and restore the login on another Mac device without needing to enter a phone number, verification code, or Telegram two-factor authentication password. This means that Telegram 2FA cannot provide complete protection in this attack scenario, as the attacker is not performing a new login but is exploiting an already trusted local session. For cryptocurrency users, the risks are further amplified. Since Telegram is widely used for exchange customer service, project communities, OTC trading, and wallet communication, once attackers gain access to user session permissions, they could impersonate the victim, read private chats, locate asset information, and even spread malicious links to contacts.

According to Cryptopolitan, a new type of macOS malware named Reaper is spreading through fake download pages of applications like WeChat and Miro, targeting the theft of cryptocurrency wallet data, browser passwords, and sensitive documents. This malware exploits the AppleScript URL to trigger the system's built-in script editor, hiding malicious code through ASCII art and spaces. After users click the run button, a fake Apple security update pop-up lures victims into entering their computer passwords.Reaper targets desktop cryptocurrency applications such as Ledger Live, Trezor Suite, and Exodus, modifying the internal code of wallets to intercept future transactions and redirect funds. It also steals saved credentials from Chrome, Firefox, and Edge, extracting files like .docx, .pdf, and .wallet from the desktop and documents folder. Reaper also installs a backdoor disguised as a Google software update directory for persistent attacks. Security experts advise users to verify download links, avoid entering passwords in unexpected pop-ups, and immediately close the page if a website requests to open the script editor.

According to market news, Microsoft's security research team has discovered that attackers have been inducing users to run malicious terminal commands by publishing fake macOS troubleshooting guides since the end of 2025, thereby stealing cryptocurrency wallets, iCloud data, and passwords saved in browsers.These fake guides are published on platforms such as Medium, Craft, and Squarespace, targeting common user issues like freeing up disk space or fixing system errors, and tricking users into copying and pasting malicious commands into the terminal, which automatically downloads and runs malware. This social engineering technique, named ClickFix, bypasses macOS's Gatekeeper security mechanism because the victims are actively executing the commands.The malware families involved include AMOS, Macsync, and SHub Stealer, which can steal cryptocurrency wallet keys from Exodus, Ledger, and Trezor, as well as usernames and passwords saved in Chrome and Firefox. In some cases, attackers also delete legitimate wallet applications and replace them with trojan versions. Apple has added a protective feature in macOS version 26.4 to prevent the pasting of potentially malicious commands.

According to CoinDesk, monitoring by CertiK reveals that the Lazarus Group is conducting an attack operation named Mach-O Man targeting executives in the fintech and cryptocurrency industries. This operation utilizes ClickFix social engineering techniques, sending fake online meeting invitations to lure victims into pasting repair commands on their Mac terminals, thereby gaining access to company and financial systems.CertiK researcher Natalie Newson stated that the Lazarus Group has stolen over $500 million through attacks on Drift and KelpDAO in the past two weeks. Mach-O Man is a modular macOS malware toolkit developed by the Chollima division of the Lazarus Group, capable of automatically deleting itself after use to evade detection.Additionally, attackers have implemented this attack by hijacking DeFi project domain names and replacing them with fake Cloudflare messages.

According to monitoring by the blockchain security firm SlowMist, MistEye has received threat intelligence from the community indicating that a malware named "MacSync Stealer" (v1.1.2) is active and highly destructive. This malware targets macOS users, stealing sensitive data including cryptocurrency wallets, browser credentials, system keychains, and infrastructure keys (SSH/AWS/K8s).The malware uses a spoofed AppleScript system dialog for phishing and displays fake error messages stating "unsupported" after data leakage. It has immediately synchronized this IOC (Indicator of Compromise) to clients. Do not execute unverified macOS scripts and remain highly vigilant against unexpected system password prompts. If an attack is suspected, immediate remediation is required: change all infrastructure credentials (SSH/AWS/K8s), invalidate any exposed keychains, and quickly migrate cryptocurrency assets to a secure wallet.

Bybit's Security Operations Center has discovered a multi-stage malware attack targeting macOS users of the search AI development tool Claude Code.Attackers used search engine optimization poisoning to push malicious domains to the top of Google search results, luring users into a counterfeit installation page, thereby stealing browser credentials, macOS keychain, Telegram sessions, VPN configurations, and cryptocurrency wallet information. Bybit stated that the malware can also establish persistent access through backdoor programs and attempts to target over 250 browser wallet extensions and multiple desktop wallet applications. This malicious infrastructure was identified on March 12, and relevant analysis, mitigation, and detection measures were completed on the same day.

OpenAI stated that during a recent industry-wide security incident, potential security issues were discovered in the third-party development library Axios that they use. After investigation, no evidence was found of user data being accessed, systems being compromised, or software being tampered with.Out of caution, OpenAI has initiated security reinforcement measures, focusing on strengthening the authentication mechanism of the macOS application to prevent malicious parties from distributing counterfeit official applications. OpenAI also reminds all macOS users to update to the latest version of the application as soon as possible, either through in-app updates or official channels, to reduce potential risks.

The Chief Information Security Officer of Slow Fog, 23pds, shared that the MacSync Stealer malware, active on the macOS platform, has shown significant evolution, with user assets already being stolen.The forwarded article mentions that it has upgraded from early low-threshold inducement methods like "dragging to terminal" and "ClickFix" to code signing and notarized Swift applications by Apple, significantly enhancing its concealment. Researchers found that the sample spreads in the form of a disk image named zk-call-messenger-installer-3.9.2-lts.dmg, disguising itself as instant messaging or utility applications to induce users to download. Unlike previous versions, the new version does not require any terminal operations from the user; instead, a built-in Swift helper pulls and executes encoded scripts from a remote server, completing the information theft process.The malware has completed code signing and has been notarized by Apple, with the developer team ID being GNJLS3UYZ4, and the relevant hash has not been revoked by Apple during analysis. This means it has a higher "trustworthiness" under the default macOS security mechanisms, making it easier to bypass user vigilance. The research also found that the DMG is unusually large, containing bait files such as LibreOffice-related PDFs to further reduce suspicion.Security researchers point out that such information-stealing Trojans often target browser data, account credentials, and cryptocurrency wallet information. As malware begins to systematically abuse Apple’s signing and notarization mechanisms, the risks of phishing and private key leakage for cryptocurrency users in the macOS environment are on the rise.

According to 23pds, the Chief Information Security Officer of Slow Fog Technology, a new variant of the information-stealing malware MacSync has emerged, successfully bypassing the macOS Gatekeeper security mechanism, resulting in the theft of user assets.This malware employs various techniques to evade detection, including file inflation, network connection validation, and self-destruct scripts after execution. Attackers can use this software to steal sensitive data from victims, such as iCloud keychains, browser passwords, and cryptocurrency wallets. Users should remain vigilant, avoid downloading software from unknown sources, promptly update operating system security patches, and take additional measures to protect the security of their crypto assets.

ChainCatcher News: Recently, the Cybersecurity Threat and Vulnerability Information Sharing Platform (NVDB) of the Ministry of Industry and Information Technology detected a high-risk out-of-bounds write vulnerability in Apple's iOS/iPadOS/macOS, which has been exploited for cyber attacks.iOS/iPadOS/macOS is an operating system developed by Apple Inc. Due to an out-of-bounds write vulnerability in its ImageIO framework, processing malicious image files may lead to memory corruption.

ChainCatcher news, according to Forbes, security company ESET has just released its latest threat report, which examines the threat landscape trends from June to November 2024. The number of password theft attacks targeting cryptocurrency wallets has increased, with the most significant rise occurring among macOS users.The report states: "According to ESET's telemetry data for the second half of 2024, the number of password-stealing software across multiple platforms (especially Windows, macOS, and Android) has increased," but compared to the first half of the year, the detection of password-stealing software targeting cryptocurrency wallets on macOS has more than doubled. Meanwhile, the number of password-stealing software on the Windows platform grew by 56%, while financial threats on the Android platform, including password-stealing malware, increased by 20%.ESET's analysis shows that the number of password-stealing software targeting the macOS platform (especially those related to cryptocurrency wallet credentials) surged by 127%. Security researchers noted: "Although these threats cannot be simply classified as password-stealing software just because they have broader functionalities, they do reveal a significant upward trend in password theft activities on the macOS platform." From a geographical perspective, ESET's analysis indicates that attacks on Bitcoin and other cryptocurrencies targeting macOS are mostly aimed at the United States, followed by Italy, China, Spain, and Japan.

ChainCatcher message, Slow Mist's Chief Information Security Officer 23pds posted a reminder that recently, the well-known cryptocurrency theft Trojan MacOS Stealer has been suddenly open-sourced.Previously, its attack source code was sold for 1 BTC, and now the open-sourcing means that more malicious attackers can easily access this tool. This not only potentially allows attackers to have "one tool per person" for attacks but may also give rise to more covert and complex attack methods, posing greater challenges to the security of cryptocurrency assets.

ChainCatcher news, according to Forbes, researchers have confirmed that a malware attack targeting macOS users has been active for four months. This attack uses malware disguised as a video conferencing application to steal passwords from Keychain, as well as session cookies and cryptocurrency wallet information from browsers like Google Chrome, Brave, and Opera.According to Tara Gould from Cado Security Labs, the attackers use AI-generated content to create fake websites and social media accounts, posing as trustworthy businesses. Victims are often contacted through platforms like Telegram, discussing business opportunities related to blockchain or cryptocurrency. Once the file is installed, users are prompted to enter their macOS password, further facilitating data theft.Security experts advise users to remain vigilant, especially regarding unfamiliar links related to business. Using protective tools like Intego VirusBarrier can effectively defend against such threats.

According to ChainCatcher news reported by Cointelegraph, North Korean hackers appear to have developed malware that can evade Apple's security checks. Researchers at Jamf Threat Labs, who focus on Apple, indicate that these applications seem to be experimental. This is the first time they have seen such technology used to infiltrate Apple's macOS operating system, but it does not run on the latest systems.Researchers found that Microsoft's VirusTotal online scanning service reported these applications as harmless, but they are actually malicious. Variants of these applications are written in Go and Python, utilizing Google Flutter applications. Flutter is an open-source development toolkit used for creating cross-platform applications.Out of six malicious applications, five are signed with developer accounts and have been temporarily notarized by Apple. Researchers wrote, "The domains and techniques in the malware are very similar to those used in other North Korean hacker malware, with indications that the malware was once signed and even temporarily passed Apple's notarization process."

ChainCatcher news, according to IT Home, developer Pedro Vieito posted an update on the Thread platform 2 days ago, stating that the macOS version of the ChatGPT app stores user conversations in plain text. OpenAI responded today that it has updated its app and encrypted the chat logs stored on Mac devices.According to Vieito's analysis, since conversations are stored in plain text outside the sandbox, this also means that conversations can be accessed by other applications, processes, or even malware running on the Mac without the user's knowledge.

ChainCatcher news, according to OpenAI's announcement, the ChatGPT desktop application is now available for all macOS users. Users can quickly access ChatGPT using the shortcut Option + Space, making it easier to chat, handle emails, take screenshots, and manage other content on the screen.In addition, OpenAI has launched a new feature that allows users to search through past conversation history. Users can also quickly and easily query any information on their computers.