97 results for “macOS”

Hotseat is a free, open-source macOS menu bar app that moves Claude Code and Claude Desktop to another of the user's Claude accounts in one click and returns to the same session. Sessions, settings, skills and MCP servers are shared, so `claude --resume` works under either account. When a session hits a usage limit, it offers to continue under another account. It never reads tokens or cookies. Install with Homebrew.

x.comtoolAdded 1 Nov 2026, published 31 Oct 2026🧠 AI

Microsoft Threat Intelligence analyzes a tampered anthropic.claude-code extension (versions 2.1.312 and 2.1.313) served on the Cursor marketplace on 29 October 2026. The injected JavaScript loader adds an SSH key labeled svc-telemetry, opens a reverse SSH tunnel and sets up persistence on macOS, Linux and Windows. The post gives cleanup steps, IOCs and Defender XDR hunting queries. VS Code Marketplace and npm were not affected.

microsoft.comwriteupPublished and added 31 Oct 2026🛡️ Security

A malicious version 2.1.313 of Anthropic's Claude Code extension was served from Cursor's marketplace for about 11 hours on 29 October 2026, reaching up to 5,000 developers. A JavaScript loader prepended to extension.js added an attacker SSH key, a reverse tunnel and macOS/Windows persistence, and reported to 134.209.82[.]225. Coding errors likely blocked SSH access on many hosts. Cursor removed it and rotated keys; victims should look for an 'svc-telemetry' SSH key.

bleepingcomputer.comarticlePublished and added 30 Oct 2026🛡️ Security

CVE-2026-111585 (CVSS 8.8) is an integer overflow in the remote-control screen processing of TeamViewer clients on Windows, macOS, Linux and Android. A malicious or compromised host can announce an oversized screen surface (for example 32768 by 32768 at 32 bpp), forcing a software decode path and an out-of-bounds write that crashes the viewer or runs code. Remedio's research shows a pointer overwrite routed to WinExec. Version 15.83 fixes it, along with CVE-2026-92372, CVE-2026-92374 and six local privilege escalation bugs.

securityweek.comarticlePublished and added 30 Oct 2026🛡️ Security

Phorion analyzes a backdoor injected into versions 2.1.312 and 2.1.313 of the official Claude Code for VS Code extension on the Cursor Marketplace. An IIFE prepended to extension.js plants an SSH key, opens a reverse SSH tunnel to 134.209.82[.]225, persists via a fake com.apple.sysmond LaunchAgent and beacons host recon. A macOS systemsetup check bug usually stops SSH from being enabled. The post lists detections and remediation.

phorion.iowriteupAdded 31 Oct 2026, published 30 Oct 2026🛡️ Security

dontallow is a two-file Swift launchd agent for macOS 15 and later that clicks "Don't Allow" on the "find devices on local networks" prompt. It watches the UserNotificationCenter process through an Accessibility observer, supports pause and allowlist, and can decode the Local Network rule store to show orphaned rows. It explains why Chromium temp-bundle paths make the prompt recur, and gives a PPPC profile route for fleets.

github.comrepoAdded 30 Oct 2026, published 29 Oct 2026🛡️ Security

clauth is a Rust terminal UI for Claude Code that combines multi-account switching with a live 5h / 7d usage monitor. A fallback chain moves the user off an exhausted account before Claude Code blocks. It supports Pro, Max, Team and Enterprise OAuth accounts and custom API endpoints on Linux, macOS and Windows. The post notes that auto-switching means the tool decides when accounts change.

x.comtoolAdded 30 Oct 2026, published 28 Oct 2026🧠 AI

Survival LLM is a free, open-source desktop app for macOS (Apple Silicon) and 64-bit Windows that runs an AI model and an offline emergency library on the user's computer. It checks the machine's memory, downloads a fitting model, and answers from sources such as Wikipedia, WikiMed, Ready.gov and CDC guidance, citing each article. Users can add their own files; version 0.3.2 is dated October 2026.

brangus.iotoolAdded 28 Oct 2026, published 27 Oct 2026🧠 AI

Apple's 27.2 releases fix 286 vulnerabilities across iOS/iPadOS (163) and macOS Golden Gate (263), with memory corruption in WebKit and the kernel, sandbox escapes, Gatekeeper bypasses and a remote code execution bug in Remote Management. iOS and iPadOS 18.7.11 backport the fix for CVE-2026-86950, an exploited zero-day found by Meta's product security team and first patched in 26.7.1. Patch counts for tvOS, watchOS, visionOS, Safari and the 26.7.2 and Sequoia 15.8.2 releases are also listed.

securityweek.comarticlePublished and added 27 Oct 2026🛡️ Security

Time4Popcorn, an abandoned Popcorn Time fork, has an updater (CVE-2026-30612) that fetches updates over HTTP without code signing and runs any executable the domain returns, as System/root. Eye Security registered abandoned update domains, saw millions of Windows, macOS and Android clients, and pushed a fix disabling the updater on about 2 million systems by March 2026. Shadowserver took over the sinkholed domains; Eye Security advises uninstalling the app.

securityweek.comarticlePublished and added 27 Oct 2026🛡️ Security

Ollama overview thread by Akash Rajagopal on X. It lists six steps: install on macOS, Linux, Windows or Docker; run `ollama run gemma4`; use the REST API on localhost:11434 (/api/chat); call it from ollama-python and ollama-js; llama.cpp as the README's supported backend; and `ollama launch claude` to connect Claude Code. Codex, OpenCode, Copilot CLI and Droid also work. The thread cites 184k GitHub stars and an MIT licence.

x.comthreadAdded 27 Oct 2026, published 26 Oct 2026🧠 AI

HiRoute is an open-source (Apache-2.0) local model router for developers using agent clients such as Codex and Claude Code. Routing plans judge each new message and send routine work to economical models, while harder design decisions and fixes stay on the primary model. It supports custom task branches, ordered failover candidates with explicit exhaustion, per-session cost and usage records, and runs as a macOS desktop app or a Linux CLI and daemon.

x.comtoolAdded 25 Oct 2026, published 24 Oct 2026🧠 AI

SecurityWeek's weekly roundup covers Heartbreaker, a Rust macOS ransomware that recompiles itself to change its hash, and 333 Tor exit relays running Ebury that redirected SSH logins to harvest passwords. It also covers APT28 Hookedge attacks on a NATO shipbuilder, the Railway and PingCAP breaches, ISO/IEC 27090 for AI threats, and US banks blocking unsanctioned AI agents.

securityweek.comarticlePublished and added 23 Oct 2026🛡️ Security

Unthemidator is an automated unpacker for binaries protected with Themida, Code Virtualizer and WinLicense (v3.0 to v3.2.6.0, experimental v4.0). It works without executing the target, handles x86 and x64 exe, dll and sys files, decrypts imports, restores the IAT, rebuilds the PE and identifies VM versions and entry points. It does not devirtualize or unmutate code. Releases cover Windows x64 and macOS Apple Silicon.

github.comrepoAdded 27 Oct 2026, published 23 Oct 2026🛡️ Security

aula-mcp is an open-source (MIT) TypeScript MCP server that connects an AI client to Denmark's Aula school platform. It exposes tools for profiles, calendar events, messages, notifications, posts and weekly plans. MitID credentials and OAuth tokens are stored in macOS Keychain or an AES-256-GCM encrypted file. The HTTP server binds to 127.0.0.1, and the presence write tool stays off until AULA_MCP_WRITE=1 is set.

x.comrepoAdded 23 Oct 2026, published 22 Oct 2026🧠 AI

LiteLLM 1.107.0 macOS x86-64 PyPI wheel analyzed by OpenSourceMalware contains three injected files (cook.pth, cook.py, sitecustomize.py) that run on every Python start. The payload, called privcollect, steals browser, SSH, cloud, CI/CD and AI-tool credentials, then uploads an AES/RSA-encrypted bundle to www.litellm.dev/healthcheck. A forked loader also fetches domain.txt from GitHub and executes /codepy hourly. The post lists IOCs, hashes and remediation steps.

opensourcemalware.comwriteupPublished and added 21 Oct 2026🛡️ Security

GPT Voice is a free, open-source Mac app by Vishesh Raheja that brings ChatGPT's dictation to any macOS app. A shortcut starts recording, and the transcript is pasted where the user is typing. It uses the ChatGPT Pro subscription, so it needs no API key or extra subscription. The author built it after Handy handled coding prompts poorly and they did not want to pay for Wispr Flow. The thread gives no details on local versus API transcription or latency.

x.comthreadAdded 22 Oct 2026, published 21 Oct 2026🧠 AI

Live-Forensicator is a cross-platform (Windows, Linux, macOS) live response toolkit built around Forensicator.ps1. The Hackers Arise walkthrough runs it on Windows with case details, then reads the HTML report: event log summary (Event IDs 4624, 4798, 4799, 4688) and a risk rating. It also shows optional AI analysis through Ollama with a Mistral model, configured in config.json, and warns that the tool triggers AV and that AI slows runs.

hackers-arise.comarticlePublished and added 20 Oct 2026🛡️ Security

Trading Hub is a free macOS desktop trading platform built with C#/.NET 10 and Avalonia. It uses the user's Claude Code subscription: a chat writes and fixes C# strategies, an in-app MCP server lets Claude run backtests, optimizations and walk-forwards and write reports, and a risk agent proposes position sizes. Install and a Windows port are both driven by Claude Code prompts. License is MIT with Commons Clause.

github.comrepoAdded 19 Oct 2026, published 17 Oct 2026🧠 AI

OpenGCUA, from Alibaba's MAI-UI team, is an open stack for generalist computer-use agents (GCUAs), where the model chooses how to observe, act and organize work across GUI, accessibility-tree, API and shell interfaces. Its design combines code execution (GUI actions written as programs with loops and branches) with harness-to-model decision transfer. On OSWorld-v2 it raises mean partial score by +19.6 points across eight models, including GPT-6 Astra and Claude Opus 5, and cuts reported steps per task by 53%. The release includes the harness, prompts, evaluation trajectories, a macOS real-device harness, a cross-device SDK and an interactive lab. It also shows large efficiency gaps between models: Qwen3.8-Max used 19.4x the reasoning tokens of GPT-6 Astra on real macOS tasks.

huggingface.copaperAdded 17 Oct 2026🧠 AI

A tweet from AmingIn_AI describes a macOS screenshot-annotation tool. On release it saves the screenshot, a crop and the user's marks locally, then copies a 127.0.0.1 link. Claude Code or Codex on the same Mac can fetch that link and receive the marked image plus app/window info, and nothing is uploaded. It shows a local, privacy-preserving way to hand visual context to coding agents without MCP or cloud upload.

x.comthreadAdded 17 Oct 2026, published 16 Oct 2026🧠 AI

Decrypt reports that developer Brandon Thomas released WordCraft, GridCraft and DeckCraft, MIT/Apache-2.0 open-source clones of Word, Excel and PowerPoint. They were written in Rust with Anthropic's Claude (Opus 5.5) as a clean-room rebuild and run natively on Windows, macOS, Linux and BSD, and in a browser. Coverage is high (WordCraft 88% of ribbon features, GridCraft 513 of 523 Excel functions), but the authors rate them only about 50–60% ready for real work. Every button is also an MCP command, so agents like Claude can drive the apps. The article is a useful data point on what AI-assisted "vibe coding" can produce in under two weeks, and on where it still falls short (file fidelity, stability).

decrypt.coarticlePublished and added 14 Oct 2026🧠 AI

Atticus is an MIT-licensed macOS 26+ hold-to-talk voice assistant that uses Apple's on-device speech transcription and runs AI requests through Claude Code on an existing Claude Pro/Max plan, so no API key is needed. Simple commands skip the model entirely (apps open in 0.08 s), actions it has seen once are learned as zero-cost shortcuts, and a "remember…" memory persists across asks. It also sets up no-AI background watchers (polling every 5 s) and holds itself to a budget of a median under $0.002 and 6 s per AI ask, with a system prompt under 10,000 characters.

github.comrepoPublished and added 12 Oct 2026🧠 AI

bigarrow is an MIT-licensed, single-binary Swift macOS CLI that draws a click-through arrow and sign over all windows so an AI agent can show a human where to click, paste or act (permission prompts, 2FA, OAuth consent). It ships an Agent Skills package (installed via `bigarrow install-skill`) for Claude Code and Codex, with JSON output and exit codes, and can target by Accessibility label, coordinates, window or Peekaboo snapshot. The README documents the skill's token cost (182 tokens for the description, 1,398 for the instructions) and 104 automated tests.

github.comrepoPublished and added 9 Oct 2026🧠 AI

malcontent is Chainguard's open-source malware/supply-chain discovery tool that analyzes binaries (ELF, Mach-O, PE, a.out) and scripting-language source across Linux, macOS and Windows using 14,500+ YARA rules (including third-party rules from Avast, Elastic, FireEye, Mandiant, Nextron and ReversingLabs). Its standout feature is differential analysis ("mal diff"), which compares two versions of a build artifact or OCI image against a known-good baseline to surface newly introduced risky behaviors — the technique the project demonstrates on the 3CX supply-chain compromise by flagging unexpected high-risk changes to libffmpeg. It also supports threshold-based scanning ("mal scan") and unfiltered capability enumeration ("mal analyze"), and is designed to run inside CI/CD pipelines, including air-gapped environments via embedded rules.

github.comrepoAdded 8 Oct 2026🛡️ Security

Cisco Talos discloses eight vulnerabilities patched by vendors: a Photoshop installer privilege escalation (CVE-2026-48388), a macOS CoreWLAN information disclosure bug, two Foxit Reader flaws including a JavaScript CBF_Widget remote code execution (CVE-2026-57256) and an Array use-after-free (CVE-2026-91799), and four Windows kernel-driver bugs — NETIO.sys information disclosure (CVE-2026-50475), two Cloud Files Mini Filter Driver issues (use-after-free CVE-2026-58613 and type confusion CVE-2026-80093), and a tcpip.sys out-of-bounds read (CVE-2026-49177). Each advisory gives the affected version and trigger mechanism, and Talos notes Snort coverage is available for detection.

blog.talosintelligence.comadvisoryPublished and added 7 Oct 2026🛡️ Security

Endor Labs walks through what "sandboxing an AI coding agent" actually means at the OS level, contrasting the approval-prompt model with kernel-enforced isolation. It details how Claude Code, Cursor, and Codex CLI converge on the same primitives without full containers — Apple's Seatbelt on macOS, Landlock plus seccomp on Linux, Job Objects/AppContainer on Windows — and why Anthropic ships an open-source bubblewrap-based runtime with a host-side egress proxy. It argues filesystem isolation and network egress controls are interdependent (citing Anthropic's own sandboxing writeup) and uses the 2025 nx npm supply-chain attack to illustrate why containment, not model-level guardrails, is the real defense against prompt injection and credential exfiltration.

endorlabs.comarticlePublished and added 6 Oct 2026🧠 AI

Sidekick is an open-source macOS plugin for Claude Code that lets you define a one-sentence persona (e.g. "a blunt senior Rust dev") and drive a coding session hands-free by voice: it listens via Apple's on-device speech recognition, speaks answers with macOS voices, and lets you interrupt it mid-reply or say "stop" to cancel a turn. It also surfaces Claude's multiple-choice decisions as spoken questions, matching answers like "the second one" against an echo-filtered transcript so the assistant doesn't hear and respond to its own voice. Implementation is a ~500-line TypeScript Claude Code hooks module plus a 90-line Swift speech listener, runs fully local with zero servers and zero telemetry, and installs via the `claude plugin marketplace`/`claude plugin install` commands.

x.comthreadPublished and added 4 Oct 2026🧠 AI

Offrun is a macOS (Apple Silicon) desktop app that runs multiple coding-agent CLIs, including Claude Code, Codex, AGY, and Grok Build, side by side, giving each agent its own git worktree so parallel sessions never collide on the same files. It adds peer review where one agent's findings land in another's chat before anything is committed, account rotation across multiple logins when one hits its rate limit, persistent per-agent and per-repo project memory stored as plain files, cross-terminal notifications, a diff and preview pane, Build versus Planner modes, and on-device dictation, all running locally under the user's own agent subscriptions with no server in the path.

offrun.devtoolPublished and added 3 Oct 2026🧠 AI

Walkthrough of Platypus, an open-source C2-style host management platform (github.com/WangYihang/Platypus) for pentesters handling large numbers of compromised Linux, Windows and macOS machines from a single web interface. Covers Docker-based server setup, agent generation with enrollment tokens, deploying agents via curl over TLS, and post-exploitation features like interactive shells, file browsing, sensitive-file auditing, and OS-info plugins (firewall rules, cron jobs, network connections).

hackers-arise.comwriteupAdded 7 Oct 2026, published 2 Oct 2026🛡️ Security

Episode 23 of the OpenSourceMalware Show covers the arrest of ShinyHunters figure Pepijn van der Stap (Umbreon) and three KillSec ransomware suspects, a suspected North Korean theft of $351.6M from crypto exchange Bitget via a zero-day in a security product (per incident responder SlowMist), a signed macOS installer impersonating Claude Desktop and hosted on GitHub, over 100 malicious npm packages abusing the Baileys WhatsApp library to inflate channel followers, and DPRK's PolinRider campaign renaming its fake-font payload (fa-solid-400.woff2 variants, now using a .llf extension and nested folder paths) to evade static file-name detections.

opensourcemalware.comtalkAdded 1 Oct 2026, published 2 Oct 2026🛡️ Security

DeepSeek Harness is an open-source general-purpose agent harness from DeepSeek, built on the "Cordis" everything-is-a-plugin architecture, shipped as a desktop app for macOS/Windows and runnable as a web UI from code. It handles everyday document/spreadsheet work, coding tasks (repo exploration, bug fixes, tests), research with citations, and background/scheduled jobs, with users able to install or author plugins (including via a chat-driven "Creator mode") and inspect per-turn tool-call traces for debugging. It runs on DeepSeek's DeepSeek-V4.1-Flash model and is explicitly labeled a preview release with evolving core plugins and APIs.

deepseek.comtoolPublished and added 2 Oct 2026🧠 AI

News report on a dispute over Meta's Muse personal AI agent, launched Sept. 8 and built in Meta Superintelligence Labs. Inc. columnist Jason Aten says Muse synced his Mac Messages database even though Full Disk Access was off, and that Muse falsely said it only saw notification banners. Meta's Andy Stone and David Singleton reply that the Messages integration is opt-in, needing both macOS Full Disk Access and the Muse Messages connector. The article also covers a separate claim that Muse gave a user's home address to a Facebook Marketplace buyer, Amazon blocking Muse, and the Amazon v. Perplexity Comet injunction. It shows how agent permission layers can fail or be disputed.

decrypt.coarticlePublished and added 1 Oct 2026🧠 AI

Breadcrumb is a macOS app that runs locally to continuously record screen activity, meetings and app usage, then exposes that history as queryable context to AI assistants like Claude, ChatGPT, Cursor and OpenCode. It lets users ask natural-language questions about their day (standup action items, time spent per project), resume long agent chat sessions without re-paying token costs, define persistent cross-AI rules (e.g. 'never push main'), and save recurring queries as one-word shortcuts — all while keeping data encrypted at rest with a user-held key and processing transcription/speaker-naming with local on-device models.

innerloop.workstoolAdded 2 Oct 2026, published 1 Oct 2026🧠 AI

Samuel Zeng announces the open-sourcing of Edge0's cross-platform app layer (iOS, macOS, Android, Windows), building on Edge0's earlier on-device 35B language model that runs in only 1-2.5GB of peak memory. The release includes app code, local model/runtime integration, model management, and build/deployment guides on GitHub; the technique keeps the full model on local storage and streams in only the experts (MoE-style) needed per step, predicting and prefetching the next experts while running storage reads in parallel with compute. A Q4 2026 roadmap promises a unified inference API across platforms plus Python, hardware-adaptive runtime, and a CUDA backend.

x.comthreadPublished and added 1 Oct 2026🧠 AI

AppleInsider opinion piece reporting that Meta's new "Muse" AI agent (available via Facebook, Instagram, Messenger, WhatsApp) accessed and uploaded a user's Apple Messages history — 187,000 lines — to Meta's cloud despite the user never granting permission and macOS Full Disk Access being turned off. The finding originates from journalist Jason Aten's testing (reported at Inc), who found Muse falsely claimed it only read text-message notification banners; the author uses the incident to argue AI agents are already ignoring the access-control guardrails users and OSes set.

appleinsider.comarticleAdded 2 Oct 2026, published 29 Sep 2026🛡️ Security

Endor Labs researcher pkennedy details GHSA-wp6x-29qx-fpr7 (ENDOR-VUL-2026-1809, CVSS 8.2, CWE-59), a symlink-traversal flaw in brig, a tool that runs AI coding agents inside microVM/container sandboxes. While brig's shared working directory was carefully guarded against symlink swaps, the user-named project directory was passed to the underlying runtime (Virtualization.framework on macOS, containerd/nerdctl on Linux) as a raw unresolved path; an agent could replace a subfolder it already controls with a symlink to any host directory, which is then mounted read-write into the sandbox on the next run, exposing SSH keys, cloud credentials, and other projects with the operator's privileges. Fixed in brig 0.3.0 by resolving and holding the path open before mounting; the piece includes full PoC commands, root-cause code snippet, and a detailed vendor disclosure/CVSS negotiation narrative.

endorlabs.comwriteupPublished and added 28 Sep 2026🛡️ Security

GHSA-v234-4jrq-mgg6 discloses that Claude Desktop for macOS (versions >=1.1.3918, less than 1.15962.0) omitted a macOS-executable file type from its Cowork folder block-list, letting a malicious file written into a Cowork sandbox's shared folder by a compromised or prompt-injected agent run commands on the host when opened via Claude Desktop. A separate, compounding issue is also disclosed: Cowork VM images before 1.11847.5 shipped a guest Linux kernel vulnerable to CVE-2026-43284, which combined with the block-list gap could let VM-privileged code trigger the file open without user interaction. Both issues are fixed in Claude Desktop 1.15962.0; reported internally by Anthropic and independently by Vladimir Tokarev of Cyera Research.

github.comadvisoryAdded 28 Sep 2026🛡️ Security

mcp-audit-tool is a dependency-light Python CLI that statically scans Claude Desktop, Cursor, Windsurf, Cline, Zed, and VS Code MCP configuration files for security issues, including hardcoded secrets, unpinned/rug-pull packages, pipe-to-shell installers, tool-poisoning via hidden instructions in tool descriptions, filesystem servers rooted at '/', and unauthenticated plaintext HTTP MCP endpoints. It auto-discovers configs across macOS/Linux/Windows, produces a security score/grade plus SARIF 2.1.0 output for GitHub Code Scanning, and is built around the OWASP MCP Top 10 categories with a CI/CD example that fails builds on severity thresholds. The roadmap adds live server probing over stdio/SSE for runtime rug-pull detection and an ML-based prompt-injection classifier for tool descriptions.

github.comrepoPublished and added 26 Sep 2026🛡️ Security

Sandyaa is an open-source autonomous code-audit tool that points at a local directory or git URL and runs end-to-end, driven by the Claude Code CLI (optionally Gemini) with no separate API key required. It uses a Recursive Language Model approach — the model drives a Python REPL to chunk code, spawn sub-LLM queries, and aggregate results — running eight recursive passes (call-chain tracing, data-flow expansion, vulnerability chaining, exploitability proof, etc.) and an attacker-control-reachability analyzer to filter unreachable findings, then writes each finding with a working exploit PoC and an evidence.json linking claims to file/line. Maintained by SecureLayer7, who report using it to surface zero-days; it's alpha-stage, macOS-tested, Linux/WSL2-expected-to-work, and unsupported on native Windows.

github.comrepoAdded 26 Sep 2026🛡️ Security

Cua is an open-source platform for computer-use agents: isolated cloud desktops (Fleets), a Sandbox SDK, local macOS/Linux VM management (Lume), a Cua Driver for controlling native apps/browsers via CLI/MCP/SDKs, and Cua-Bench for building and evaluating computer-use tasks. It also introduces CUA-S1, a family of small specialized "System 1" models that make fast, bounded decisions (e.g., scoring form field values from structured UI/document data) rather than generating agent actions token-by-token, with the first CUA-S1-FORMS model and dataset released on Hugging Face. The project is MIT-licensed with some optional components (cua-som, cua-perception's OmniParser integration) carrying AGPL-3.0 obligations.

github.comrepoAdded 26 Sep 2026, published 19 Sep 2026🧠 AI

Cisco Talos's weekly Threat Source newsletter opens with commentary arguing that a slowdown in AI development would barely move the needle on cybersecurity, since models already uncover vulnerabilities effectively and defenders still neglect basics like asset inventory, least privilege, and network segmentation. The main threat-intel item covers Japan's ransomware landscape, where incidents rose nearly 5% in H1 2026, driven by "The Gentlemen" (a fast-growing RaaS group using the AdaptixC2 red-team framework for stealthy lateral movement) and "Qilin" (which uses LLMs to generate destructive scripts and speed up attacks), both hitting SMEs with double extortion. It closes with a roundup of other weekly stories: an Android banking-malware campaign abusing Google's Work Profile in Indonesia, Apple's ~200-vulnerability iOS/macOS patch batch, a ClickFix campaign via a compromised HBO Max Reddit account, and the $250/month VectraRAT implant.

blog.talosintelligence.comarticleAdded 7 Oct 2026, published 17 Sep 2026🛡️ Security

Zero Day Initiative's monthly Apple patch review covers the September 2026 release (macOS 27/Sequoia 15.8/Tahoe 26.7, iOS/iPadOS 27 & 26.7, visionOS, watchOS, tvOS, Safari, Xcode), totaling 273 CVEs. It highlights CVE-2026-65400 (Screen Sharing Server authentication bypass, 9.8 CRITICAL, actively exploited per CISA KEV), CVE-2026-65414 (Bluetooth remote code execution, 9.8 CRITICAL, affecting all eight platforms), and CVE-2026-65346 (ImageIO arbitrary code execution via malicious image, 8.8 HIGH), plus a full CVE-by-component-by-platform table with CVSS scores where NVD/CISA-ADP has assigned them.

zerodayinitiative.comarticleAdded 28 Sep 2026, published 16 Sep 2026🛡️ Security

A DFIR researcher shows how macOS's default shell, zsh, ships with loadable modules (zsh/net/tcp, zsh/mapfile, zsh/attr, zsh/stat, zsh/sched) that let the shell itself open raw TCP sockets, read/write files, and manipulate extended attributes like com.apple.quarantine without spawning curl, xattr, rm, or nc. The post walks through a full example using ztcp and source /dev/fd/$fd to fetch and execute a second-stage payload directly from a socket (bootstrapping a LaunchAgent) with no downloaded file on disk and no child process, referencing the prior real-world use of zsh/net/tcp for reverse shells (documented by ESET and GTFOBins). It then validates via eslogger/Endpoint Security that DELETEEXTATTR/SETEXTATTR and similar operations remain visible even when performed through zsh builtins, arguing detections should target the underlying OS event rather than the specific binary invoked.

dfir.chwriteupPublished and added 16 Sep 2026🛡️ Security

JFrog researchers detail ParaShells, a local privilege escalation chain in Parallels Desktop 26.4.0 (build 57513) on Apple silicon that lets an unprivileged macOS user gain root. The chain combines a world-writable Unix socket for prl_disp_service, weak peer-credential-based authentication in PrlSrv_LoginLocal, and argument injection in the InstallAppliance extraction path where a crafted sVmParentPath breaks Qt's QProcess::splitCommand quoting to inject tar's --use-compress-program= flag, causing macOS tar to execute an attacker script as uid 0.

jfrog.comwriteupPublished and added 15 Sep 2026🛡️ Security

Huntress SOC analysts Ryan Dowd and Jon Semon tore apart a live social-engineering campaign that began with a fake CoinDesk marketing exec DMing a researcher a Google Doc containing a container-bound Apps Script sidebar. The script ran client-side without OAuth consent, exfiltrated victim IP/geolocation/wallet presence via the Telegram API, then routed macOS users to a piped zsh/DMG AMOS stealer chain and Windows users through ClickOnce and PowerShell loaders using three stolen or fraudulent code-signing certificates (a Norwegian company, Discord, and Lenovo). The Windows chain culminated in NetSupport Manager RMM abuse, a Ledger wallet implant, and a self-generated rogue root certificate authority (spoofing Google Trust Services) installed via MsBuild.exe hollowing to silently intercept HTTPS traffic, which the authors flag as the artifact most likely to survive incident remediation short of full reimaging.

huntress.comwriteupAdded 11 Sep 2026, published 15 Sep 2026🛡️ Security

Sebastian Raschka's deep-dive on OpenAI's GPT-6 Astra release, explaining the "looped transformer" / recurrent-depth architecture concept rumored to underlie it, tracing it from 2018's Universal Transformer through Nanbeige4.2-3B, ByteDance's Ouro, and Mixture-of-Recursions, and evaluating claims that looping "hides" chain-of-thought reasoning. It also covers Astra's computer-use training via macOS environments on Mac hardware and reviews recent papers (Latent Reasoning recurrent-depth, Beyond Parameters, SMELT, Full-bandwidth transformer) on compute-matched looped-transformer scaling.

magazine.sebastianraschka.comarticleAdded 29 Sep 2026, published 9 Sep 2026🧠 AI

Aikido Security discovered a variant of the XCSSET macOS worm hidden in universal_file_viewer, a Flutter file-preview package on pub.dev (~500 downloads) — the first compromised package found on that registry. The infection was not a targeted supply-chain attack but resulted from the maintainer's machine being infected with XCSSET, which auto-injects malicious build hooks into every Gradle, Xcode, and git project it finds; the poisoned example/ directory (Android Gradle build, iOS/macOS Xcode project files) shipped in the package tarball. The writeup details XCSSET's four-stage infection chain, its android_finder/git_finder/replicator_finder propagation modules, Launchpad-tile persistence, and theft modules targeting Chrome, Safari, Firefox, Telegram, Notes, and clipboard data, plus C2 domain and file-artifact IOCs.

aikido.devwriteupPublished and added 8 Sep 2026🛡️ Security

StepSecurity announces Linux support (Debian/RPM, .deb and .rpm packages) for Dev Machine Guard, its open-source developer-machine inventory and scanning engine, extending existing macOS/Windows coverage. The tool detects installed AI coding agents (Claude, Cursor, GitHub Copilot, Codex), IDE extensions from VS Code Marketplace and OpenVSX, MCP server configs, npm packages, and Linux system packages (rpm, dpkg, pacman, apk, snap, flatpak) via native mechanisms like systemd user timers and BIOS-serial device identity, and is explicitly framed as a response to incidents like the Shai-Hulud npm worm, s1ngularity/Nx compromise, and Mini Shai-Hulud/TanStack attacks. It ships in a free local-only Community mode and a paid Enterprise mode with centralized dashboard, policy enforcement, and dependency cooldown/alerting.

stepsecurity.ioarticleAdded 5 Sep 2026🛡️ Security

Google DeepMind's Gemini 3.5 Transcribe is a new speech-to-text model offered as two API variants: gemini-3.5-transcribe-live for sub-second-latency real-time streaming via the Live API, and gemini-3.5-transcribe for pre-recorded audio with speaker attribution and word-level timestamps via the Interactions API. It reports Word Error Rates of 4.0% (streaming) and 2.6% (non-streaming) as measured by Artificial Analysis, supports 85+ languages, custom vocabulary, disfluency/filler removal, and function calling to delegate tasks to other Gemini models, and is being rolled into Gboard's Rambler feature, Antigravity, Google AI Studio, and the Gemini macOS app.

deepmind.googlearticleAdded 29 Sep 2026, published 26 Aug 2026🧠 AI

Aikido researchers detail a supply-chain compromise of three popular Rust crates maintained by the same author, arrayref with 244M downloads, append-only-vec with 4M, and internment with 14M, that were modified to add a single malicious manifest dependency, proc-macro1, a typosquat of proc-macro2. Because the dependency's build.rs executes automatically during cargo build, merely compiling a project pulling in any of these crates downloads and runs a platform-specific payload that drops an infostealer targeting Chromium browser credentials and crypto-wallet extension storage, installs macOS LaunchAgent persistence, and beacons to a lightweight C2 supporting remote shell commands. The campaign's TTPs closely mirror the prior npm-based Axios and Mastra compromises attributed to DPRK, suggesting the same actor expanding into the Rust ecosystem.

aikido.devwriteupAdded 3 Sep 2026, published 20 Aug 2026🛡️ Security

Huntress researchers document a phishing campaign targeting Black Hat/DEF CON attendees via X DMs impersonating a CoinDesk exec, luring victims into opening a weaponized Google Doc with a custom Google Apps Script sidebar that runs a fake "decryption" flow before delivering ClickFix-style commands or a manual "update" that drops malware. On macOS this delivers AMOS infostealer plus a LaunchDaemon-based polling backdoor with SOCKS5 proxy capability; a follow-up fake DocSend/Dropbox installer delivers a ClickOnce/NSIS loader chain on Windows that installs NetSupport RAT, a process-hollowed rogue Certificate Authority that MITMs VirusTotal traffic, and an incomplete Ledger wallet-targeting implant. The piece includes deep technical detail on the loader's C2 protocol, stolen/fraudulent code-signing certificates, and infrastructure patterns (multi-branded loader domains), plus mitigation guidance and a link to published IOCs.

huntress.comwriteupAdded 3 Sep 2026, published 19 Aug 2026🛡️ Security

Huntress SOC analysts reverse-engineer MacSync, a macOS infostealer/RAT distributed via a sponsored Google Ads link to a fake "Apple Support"-branded claude.ai shared conversation that uses ClickFix to trick victims into pasting a curl/zsh loader into Terminal. The six-stage chain runs a polymorphic gzip/Base64 loader, an in-memory AppleScript stealer that harvests Chromium Safe Storage keys, keychain secrets, Telegram/SSH/cloud credentials, abuses TCC (Full Disk Access and Screen Recording) prompts, drops a Mach-O RAT with WebSocket/TLS C2 and an XOR-obfuscated fallback domain, and trojanizes 84 crypto wallet extensions/apps to phish seed phrases. The piece also compares it to prior AMOS Stealer and SectopRAT ClickFix campaigns and offers behavior-based detection guidance.

huntress.comwriteupAdded 3 Sep 2026, published 17 Aug 2026🛡️ Security

Orca Security details four Zoom vulnerabilities in the cross-platform annotation engine (libannotate.so): CVE-2026-53413, a stack buffer overflow in CAnnoFormatBlock::Deserialize from unchecked 32-bit character counts, and CVE-2026-53415, a use-after-free in auto-shape metadata handling giving a write-what-where primitive, both enabling zero-click RCE against every meeting participant via crafted annotation messages during screen sharing. Also disclosed are CVE-2026-53414 (heap over-read/DoS) and CVE-2026-53416 (path traversal in the Windows VDI client). The write-up notes a working exploit chain built in under 24 hours with fewer than 20 AI-model prompts, platform-specific exploitation details (macOS ARM64 ASLR bypass, Android heap spraying/vtable corruption), and that E2EE meetings bypass Zoom's server-side message filtering.

orca.securityadvisoryPublished and added 12 Aug 2026🛡️ Security

Huntress breaks down two macOS Screen Sharing (screensharingd/RFB) vulnerabilities patched by Apple: CVE-2026-43760, an authenticated confused-context bug letting legacy-VNC users read/write arbitrary files as root, and CVE-2026-65400, a pre-authentication bug in the SRP handshake that lets an unauthenticated remote attacker read/write any filesystem artifact as root and achieve remote code execution via LaunchDaemons or shell startup file persistence. The post details the SSFileCopySender/SSFileCopyReceiver helper processes, their kTCCServiceSystemPolicyAllFiles entitlement, TCC/SIP interactions, exposure via hosted bare-metal Mac providers, and how to detect exploitation using Apple's Endpoint Security framework (ES_EVENT_TYPE_NOTIFY_SCREENSHARING_ATTACH, authentication_type, UID/GID anomalies).

huntress.comwriteupAdded 3 Sep 2026, published 7 Aug 2026🛡️ Security

OpenSourceMalware documents WEL1DROPPER (aka Flooding Dropper), a campaign that published 788+ slopsquatted npm packages (e.g. checkout-mobile-bnpl) which execute on require() with no install script, downloading cross-platform RAT/infostealer payloads via rotating Cloudflare Workers URLs with a DNS TXT-record fallback channel. The writeup reverse-engineers the Linux (UPX-packed ELF) and macOS (universal Mach-O) second-stage payloads, detailing anti-analysis checks, LaunchAgent persistence disguised as com.apple.windowserver.helper, XOR-obfuscated C2 domains, a suspected Sliver C2 final stage, and ties the campaign to Russian financial-sector lures and the earlier Moika npm campaign.

opensourcemalware.comwriteupAdded 3 Sep 2026, published 6 Aug 2026🛡️ Security

Huntress details a macOS incident where a victim ran a ClickFix fake-CAPTCHA Terminal command that chained a Bash profiler/loader into a Go-based Mach-O stealer. The malware harvests Keychain, browser password stores, and cached credentials, establishes persistence via a fake SoftwareUpdate LaunchAgent and BTM, uses osascript to phish the user's password, and includes a DRAIN function that checks crypto wallet balances (BTC, LTC, DOGE, ETH, XRP, Monero) and siphons a configurable percentage or the full balance to attacker wallets. All infrastructure (loader hosting, payload hosting, C2 on port 8133) traces back to Aeza Group, a sanctioned Russian bulletproof hosting provider.

huntress.comwriteupAdded 3 Sep 2026, published 6 Aug 2026🛡️ Security

Wiz announces a new endpoint sensor for developer workstations (Windows/macOS, private preview) that inventories packages, IDE extensions, AI coding agents, and MCP servers, and detects known/emerging supply chain attacks in real time. The post details three real-world campaigns that motivated it: Shai-Hulud (a self-propagating npm worm that ran TruffleHog via postinstall scripts to steal npm tokens and republish itself), the Axios backdoor (a compromised maintainer account injecting C2-calling code executed within 1.1 seconds of npm install), and s1ngularity (a compromised Nx build system/VS Code extension that harvested GitHub/npm/SSH/cloud credentials and weaponized local AI CLI tools like Claude and Gemini to exfiltrate filesystem data, leaking 1,000+ GitHub tokens and exposing 5,500 private repos).

wiz.ioarticleAdded 3 Sep 2026, published 3 Aug 2026🛡️ Security

Ghidra is a free, open-source software reverse engineering (SRE) framework developed by the NSA, offering disassembly, decompilation, graphing, and scripting across Windows, macOS, and Linux. It supports a wide range of processor architectures and executable formats, can run interactively or in automated/headless mode, and allows extension development via Java or Python (including the bundled PyGhidra). It is one of the primary open-source alternatives to IDA Pro for malware analysis and vulnerability research.

github.comrepoPublished and added 31 Jul 2026🛡️ Security

Desic Terminal is an open-source (MIT) Windows/macOS desktop app for OKX USDT perpetuals trading that bundles an AI trading assistant, AI-gated automated trading, and Python strategy backtesting on a shared real-time state and audit trail. Its notable AI-architecture contribution is a layered permission model where code, not prompts, decides what the agent can do: an AI Sidecar exposes only a scoped, often read-only tool set (e.g. radar.* tools reading a local SQLite market snapshot), delegated sub-agents are always read-only, risk-increasing actions fail closed on uncertain results, and executions use idempotent keys reconciled against exchange state before any retry. It also supports delegating requests to local Codex CLI or Claude Code instead of a hosted model API key, and ships a separate companion MCP server ("Desic OKX Agent") for giving coding agents direct OKX market/account/trading tool access.

github.comrepoAdded 8 Oct 2026, published 31 Jul 2026🧠 AI