Cybersecurity articles tagged #macOS on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/apple-patches-ios-ipados-18-and-macos-108-vulnerabilities-addressedhttps://runtimerebel.com/blog/apple-patches-ios-ipados-18-and-macos-108-vulnerabilities-addressedApple has released significant security updates for iOS/iPadOS 18 and macOS, fixing 108 vulnerabilities, none exploited in the wild.Tue, 18 Aug 2026 00:42:55 GMTAppleiOSiPadOSmacOSWebKithttps://runtimerebel.com/blog/apple-screen-sharing-exploits-secure-your-macos-systems-nowhttps://runtimerebel.com/blog/apple-screen-sharing-exploits-secure-your-macos-systems-nowCritical vulnerabilities in Apple Screen Sharing are actively exploited, allowing system compromise. Learn how to secure macOS against these threats.Mon, 17 Aug 2026 16:20:27 GMTApplemacOSExploitationRemote AccessScreen Sharinghttps://runtimerebel.com/blog/amnesiastealer-macos-malware-hijacks-browser-sessions-via-remote-controlhttps://runtimerebel.com/blog/amnesiastealer-macos-malware-hijacks-browser-sessions-via-remote-controlAmnesiaStealer targets macOS users via ClickFix attacks, cloning Chromium profiles to enable live remote control of authenticated browser sessions.Sun, 16 Aug 2026 16:14:35 GMTmacOSInfostealerClickFixChromiumAmnesiaStealerhttps://runtimerebel.com/blog/macos-screen-sharing-flaw-exploited-to-deploy-monero-minerhttps://runtimerebel.com/blog/macos-screen-sharing-flaw-exploited-to-deploy-monero-minerThe Netherlands NCSC warns that hackers are actively exploiting an authentication bypass flaw in macOS Screen Sharing to deploy cryptocurrency miners.Fri, 14 Aug 2026 16:41:52 GMTCVE-2026-65400macOSCryptojackingMoneroAuthentication Bypasshttps://runtimerebel.com/blog/clickfix-attacks-deliver-macos-stealer-targeting-cryptohttps://runtimerebel.com/blog/clickfix-attacks-deliver-macos-stealer-targeting-cryptoClickFix social engineering campaigns target macOS users with Go-based infostealers designed to drain cryptocurrency wallets and credentials.Mon, 10 Aug 2026 00:59:16 GMTmacOSMalwareCryptocurrencyPhishingCredential Thefthttps://runtimerebel.com/blog/natjack-attacks-exploiting-nat-trust-in-windows-linux-macoshttps://runtimerebel.com/blog/natjack-attacks-exploiting-nat-trust-in-windows-linux-macosSynack's research reveals NatJack attacks, a new class of NAT exploitation affecting Windows, Linux, and macOS, leveraging trust assumptions.Sun, 09 Aug 2026 00:58:42 GMTWindowsLinuxmacOSNatJackNAThttps://runtimerebel.com/blog/xcsset-v40-malware-targets-macos-developers-via-xcodehttps://runtimerebel.com/blog/xcsset-v40-malware-targets-macos-developers-via-xcodeDiscover how XCSSET v40 targets macOS developers using fileless persistence, memory execution, and Xcode project supply chain attacks.Sat, 08 Aug 2026 01:00:18 GMTXCSSETmacOSXcodeSupply Chain AttackMalwarehttps://runtimerebel.com/blog/clickfix-attack-deploys-macos-infostealer-for-crypto-thefthttps://runtimerebel.com/blog/clickfix-attack-deploys-macos-infostealer-for-crypto-theftThe ClickFix attack leverages a Go-based macOS infostealer to pilfer cryptocurrency, browser data, and Apple Keychain credentials via a Bash script loader.Fri, 07 Aug 2026 02:08:44 GMTClickFixmacOSInfostealerCryptocurrencyGolanghttps://runtimerebel.com/blog/clickfix-campaign-uses-server-side-fingerprinting-to-hide-macos-malwarehttps://runtimerebel.com/blog/clickfix-campaign-uses-server-side-fingerprinting-to-hide-macos-malwareOver 250 ClickFix domains utilize server-side browser fingerprinting to evade security sandboxes and distribute macOS infostealers like AMOS.Thu, 06 Aug 2026 01:56:14 GMTPhishingMalwareCredential TheftmacOSAtomic Stealerhttps://runtimerebel.com/blog/dprk-linked-macos-malvertising-uses-fake-updates-for-crypto-thefthttps://runtimerebel.com/blog/dprk-linked-macos-malvertising-uses-fake-updates-for-crypto-theftNorth Korean threat actors are using deceptive full-screen macOS update pages to distribute crypto-stealing malware in a new Contagious Interview campaign.Thu, 30 Jul 2026 21:11:51 GMTmacOSLazarus GroupMalvertisingCryptocurrencyDPRKhttps://runtimerebel.com/blog/apple-july-2026-security-updates-patching-macos-26-and-safarihttps://runtimerebel.com/blog/apple-july-2026-security-updates-patching-macos-26-and-safariApple releases widespread security updates for macOS 26, legacy macOS 14 and 15, iOS, and Safari. Organizations must patch to mitigate remote execution risks.Wed, 29 Jul 2026 10:43:22 GMTApplemacOSSafariiOSSecurity UpdatesPatch Managementhttps://runtimerebel.com/blog/claude-cowork-sandbox-escape-vm-to-macos-file-accesshttps://runtimerebel.com/blog/claude-cowork-sandbox-escape-vm-to-macos-file-accessA critical sandbox escape vulnerability in Anthropic's Claude Cowork allows AI agents to break out of their Linux VM, gaining full file access on macOS hosts, affecting…Thu, 23 Jul 2026 17:26:58 GMTClaude CoworkAnthropicmacOSSandbox EscapeVM EscapeAI SecurityData Privacyhttps://runtimerebel.com/blog/clicklock-macos-malware-password-theft-via-forced-login-prompthttps://runtimerebel.com/blog/clicklock-macos-malware-password-theft-via-forced-login-promptClickLock macOS malware terminates processes, simulating a system crash to force users into revealing their login password.Fri, 17 Jul 2026 02:45:47 GMTmacOSClickLockInformation StealerPassword TheftSocial Engineeringhttps://runtimerebel.com/blog/clicklock-macos-stealer-how-attackers-coerce-victims-via-app-kill-loopshttps://runtimerebel.com/blog/clicklock-macos-stealer-how-attackers-coerce-victims-via-app-kill-loopsClickLock is a new macOS infostealer that terminates essential system processes every 210ms to force users into disclosing their login passwords.Thu, 16 Jul 2026 14:03:10 GMTmacOSInfostealerClickLockSocial EngineeringPersistencehttps://runtimerebel.com/blog/pamstealer-new-macos-malware-targets-pam-for-password-exfiltrationhttps://runtimerebel.com/blog/pamstealer-new-macos-malware-targets-pam-for-password-exfiltrationJamf Threat Labs identifies PamStealer, a macOS malware using fake sites and AppleScript to steal login passwords through PAM exploitation.Fri, 03 Jul 2026 10:38:45 GMTPamStealermacOSJamf Threat LabsAppleScriptCredential Thefthttps://runtimerebel.com/blog/june-apple-security-updates-for-ios-macos-safari-patch-nowhttps://runtimerebel.com/blog/june-apple-security-updates-for-ios-macos-safari-patch-nowApple released essential security updates for iOS/iPadOS, macOS, and Safari in June. Learn why timely patching is critical for protecting your devices and data.Tue, 30 Jun 2026 12:52:07 GMTAppleiOSiPadOSmacOSSafariSecurity UpdatesPatch Managementhttps://runtimerebel.com/blog/airdrop-and-quick-share-proximity-flaws-cause-crashes-and-bypass-checkshttps://runtimerebel.com/blog/airdrop-and-quick-share-proximity-flaws-cause-crashes-and-bypass-checksResearchers found six security flaws in AirDrop and Quick Share, enabling nearby attackers to crash devices and bypass security checks without user interaction.Tue, 30 Jun 2026 12:49:12 GMTAirDropQuick SharemacOSiOSAndroidWireless SecurityProximity AttackDenial of ServicePrivacy Bypasshttps://runtimerebel.com/blog/jinx-0164-targets-crypto-firms-with-macos-malware-and-fake-lureshttps://runtimerebel.com/blog/jinx-0164-targets-crypto-firms-with-macos-malware-and-fake-luresThe JINX-0164 threat actor targets cryptocurrency firms via recruitment-themed social engineering, macOS-specific malware, and CI/CD infrastructure exploits.Thu, 28 May 2026 09:22:52 GMTJINX 0164macOSCryptocurrencyCI CDSocial Engineeringhttps://runtimerebel.com/blog/ai-assisted-macos-kernel-exploit-on-apple-m5-hardwarehttps://runtimerebel.com/blog/ai-assisted-macos-kernel-exploit-on-apple-m5-hardwareSecurity researchers used Anthropic’s Mythos AI to develop a macOS kernel memory corruption exploit for the Apple M5 chip in just five days. Patch now.Thu, 21 May 2026 20:42:22 GMTApple M5macOSAnthropic MythosKernel ExploitMemory CorruptionZero-Dayhttps://runtimerebel.com/blog/shub-reaper-stealer-backdoors-macos-via-spoofed-appshttps://runtimerebel.com/blog/shub-reaper-stealer-backdoors-macos-via-spoofed-appsSHub Reaper stealer targets macOS, using fake Google, Microsoft, Apple, WeChat, and Miro installers for Apple script-based execution and backdooring.Tue, 19 May 2026 20:42:42 GMTSHub ReapermacOSStealerBackdoorPhishingAppleScripthttps://runtimerebel.com/blog/shub-macos-infostealer-spoofs-apple-security-updates-installs-backdoorhttps://runtimerebel.com/blog/shub-macos-infostealer-spoofs-apple-security-updates-installs-backdoorA new SHub macOS infostealer variant employs fake Apple security update prompts via AppleScript to install a backdoor, threatening user data and system integrity.Tue, 19 May 2026 00:57:05 GMTSHubmacOSInfostealerAppleScriptBackdoorPhishinghttps://runtimerebel.com/blog/cve-2024-38812-how-to-mitigate-vmware-fusion-privilege-escalationhttps://runtimerebel.com/blog/cve-2024-38812-how-to-mitigate-vmware-fusion-privilege-escalationVMware Fusion 13.6 fixes a high-severity local privilege escalation flaw (CVE-2024-38812) that allows attackers to gain root access on macOS hosts.Thu, 14 May 2026 09:04:56 GMTCVE-2024-38812VMware FusionBroadcommacOSPrivilege Escalationhttps://runtimerebel.com/blog/apple-macos-sonoma-14-5-and-ios-17-5-patch-technical-analysishttps://runtimerebel.com/blog/apple-macos-sonoma-14-5-and-ios-17-5-patch-technical-analysisApple addresses critical security flaws in macOS and iOS, including kernel-level RCE and a privacy bug causing deleted media to reappear on devices.Tue, 12 May 2026 12:49:41 GMTApplemacOSiOSCVE-2024-27822Kernel Securityhttps://runtimerebel.com/blog/apple-may-2024-security-updates-address-84-vulnerabilitieshttps://runtimerebel.com/blog/apple-may-2024-security-updates-address-84-vulnerabilitiesApple's May 2024 security updates patch 84 vulnerabilities across iOS, macOS, watchOS, tvOS, and visionOS. Immediate patching is crucial for all users.Tue, 12 May 2026 00:50:06 GMTAppleiOSmacOSiPadOSwatchOStvOSvisionOSSecurity UpdateVulnerabilitieshttps://runtimerebel.com/blog/macsync-stealer-distributed-via-malicious-homebrew-ad-campaignhttps://runtimerebel.com/blog/macsync-stealer-distributed-via-malicious-homebrew-ad-campaignMalicious ads for Homebrew distribute MacSync Stealer, targeting macOS users. Threat actors leverage trusted software to deploy data-stealing malware.Fri, 01 May 2026 20:25:24 GMTMacSync StealerHomebrewmacOSMalvertisingData Thefthttps://runtimerebel.com/blog/sapphire-sleet-s-clickfix-north-korea-targets-macos-usershttps://runtimerebel.com/blog/sapphire-sleet-s-clickfix-north-korea-targets-macos-usersNorth Korea-backed Sapphire Sleet is deploying ClickFix malware via fake job offers and phony Zoom updates to steal macOS user credentials and data.Thu, 16 Apr 2026 20:22:49 GMTSapphire SleetClickFixmacOSNorth KoreaPhishingData TheftAPThttps://runtimerebel.com/blog/openai-revokes-macos-app-certificate-following-supply-chain-attackhttps://runtimerebel.com/blog/openai-revokes-macos-app-certificate-following-supply-chain-attackOpenAI revokes its macOS app signing certificate after a GitHub Actions workflow downloaded a malicious Axios library version during a supply chain incident.Mon, 13 Apr 2026 08:48:46 GMTOpenAImacOSAxiosGitHub ActionsSupply Chain Securityhttps://runtimerebel.com/blog/exchange-online-mailbox-access-issues-persist-for-outlook-usershttps://runtimerebel.com/blog/exchange-online-mailbox-access-issues-persist-for-outlook-usersMicrosoft Exchange Online users on Outlook mobile and macOS are experiencing intermittent mailbox access issues for weeks; investigation ongoing.Fri, 03 Apr 2026 12:21:54 GMTMicrosoft Exchange OnlineOutlook MobilemacOSService DegradationAvailability Issueshttps://runtimerebel.com/blog/apple-darksword-protection-expands-mitigating-cve-2023-38604-zero-click-exploitshttps://runtimerebel.com/blog/apple-darksword-protection-expands-mitigating-cve-2023-38604-zero-click-exploitsApple expands DarkSword exploit protection to all users, enhancing defenses against state-sponsored and commercial zero-click attacks like CVE-2023-38604.Thu, 02 Apr 2026 16:27:21 GMTAppleDarkSwordCVE-2023-38604Zero ClickExploit KitState SponsoredCommercial SpywareiOSmacOSiPadOSwatchOStvOShttps://runtimerebel.com/blog/axios-npm-package-hijacked-cross-platform-malware-distributionhttps://runtimerebel.com/blog/axios-npm-package-hijacked-cross-platform-malware-distributionAnalysis of the Axios npm package hijack distributing remote access trojans to Linux, Windows, and macOS systems. Learn to protect your software supply chain.Tue, 31 Mar 2026 16:29:10 GMTAxiosNPMSupply Chain AttackRemote Access TrojanMalwareJavaScriptLinuxWindowsmacOShttps://runtimerebel.com/blog/macos-terminal-clickfix-protections-blocking-malicious-shell-commandshttps://runtimerebel.com/blog/macos-terminal-clickfix-protections-blocking-malicious-shell-commandsApple introduces Terminal warnings in macOS Sequoia 15.2 to combat ClickFix social engineering attacks that trick users into executing malicious shell scripts.Mon, 30 Mar 2026 16:28:10 GMTmacOSSequoiaClickFixSocial EngineeringTerminalMalwarehttps://runtimerebel.com/blog/infinity-stealer-macos-malware-analyzing-clickfix-lures-and-payloadshttps://runtimerebel.com/blog/infinity-stealer-macos-malware-analyzing-clickfix-lures-and-payloadsInfinity Stealer targets macOS via ClickFix social engineering. Learn how this Nuitka-compiled malware steals browser data, crypto wallets, and Keychain info.Sat, 28 Mar 2026 16:13:39 GMTmacOSInfinity StealerInfostealerNuitkaClickFixSocial Engineeringhttps://runtimerebel.com/blog/clickfix-social-engineering-drops-infiniti-stealer-on-macoshttps://runtimerebel.com/blog/clickfix-social-engineering-drops-infiniti-stealer-on-macosAttackers use fake Cloudflare CAPTCHA pages and ClickFix tactics to deliver the Python-based Infiniti Stealer to macOS systems via terminal commands.Sat, 28 Mar 2026 12:21:09 GMTmacOSInfiniti StealerClickFixSocial EngineeringCloudflare Lureshttps://runtimerebel.com/blog/apple-addresses-85-vulnerabilities-in-recent-os-updateshttps://runtimerebel.com/blog/apple-addresses-85-vulnerabilities-in-recent-os-updatesApple released significant security updates patching 85 vulnerabilities across macOS, iOS, iPadOS, tvOS, watchOS, and visionOS, with no active exploitation reported.Thu, 26 Mar 2026 00:41:00 GMTApplemacOSiOSiPadOStvOSwatchOSvisionOSSecurity UpdateVulnerabilitiesPatch Managementhttps://runtimerebel.com/blog/cve-2026-20643-apple-patches-webkit-same-origin-policy-bypasshttps://runtimerebel.com/blog/cve-2026-20643-apple-patches-webkit-same-origin-policy-bypassApple addresses CVE-2026-20643, a critical WebKit Navigation API flaw allowing Same-Origin Policy bypass on iOS and macOS. Deploy updates immediately.Wed, 18 Mar 2026 08:20:23 GMTAppleWebKitCVE-2026-20643iOSmacOSSOP Bypasshttps://runtimerebel.com/blog/apple-cve-2026-20643-webkit-flaw-fixed-via-background-updatehttps://runtimerebel.com/blog/apple-cve-2026-20643-webkit-flaw-fixed-via-background-updateApple deploys the first Background Security Improvements update to address a critical WebKit vulnerability (CVE-2026-20643) across iOS and macOS platforms.Wed, 18 Mar 2026 04:44:24 GMTAppleWebKitCVE-2026-20643iOSmacOSPatch Managementhttps://runtimerebel.com/blog/clickfix-campaigns-deliver-macsync-macos-infostealer-via-fake-ai-toolshttps://runtimerebel.com/blog/clickfix-campaigns-deliver-macsync-macos-infostealer-via-fake-ai-toolsThreat actors use ClickFix social engineering tactics to deploy the MacSync infostealer on macOS systems via fraudulent AI software installers.Mon, 16 Mar 2026 12:24:32 GMTMacsyncClickFixmacOSInfostealerSocial Engineeringhttps://runtimerebel.com/blog/apple-patches-cve-2023-43010-webkit-vulnerability-in-older-deviceshttps://runtimerebel.com/blog/apple-patches-cve-2023-43010-webkit-vulnerability-in-older-devicesApple backports fixes for CVE-2023-43010 in older iOS and macOS versions to defend against the Coruna exploit kit targeting WebKit memory corruption.Thu, 12 Mar 2026 12:17:21 GMTCVE-2023-43010AppleiOSmacOSWebKitCoruna Exploit Kithttps://runtimerebel.com/blog/npm-malware-openclaw-ai-openclawai-macos-credential-theft-alerthttps://runtimerebel.com/blog/npm-malware-openclaw-ai-openclawai-macos-credential-theft-alertSecurity alert for @openclaw-ai/openclawai, a malicious npm package targeting macOS users to deploy remote access trojans and steal sensitive credentials.Mon, 09 Mar 2026 20:11:58 GMTNPMmacOSMalwareRATOpenClawSupply Chain Attackhttps://runtimerebel.com/blog/macos-coreaudiod-type-confusion-exploitation-cve-2024-54529https://runtimerebel.com/blog/macos-coreaudiod-type-confusion-exploitation-cve-2024-54529Analysis of CVE-2024-54529, a critical type confusion vulnerability in macOS coreaudiod, detailing its exploitation and necessary mitigations.Wed, 25 Feb 2026 04:47:23 GMTmacOSCoreaudiodCVE-2024-54529Type ConfusionExploitationCoreAudioCVE-2025-31235