⚡How just opening a webpage in Safari could have HACKED your macOS system

Details & PoC → https://thehackernews.com/2018/11/apple-macos-zeroday.html

Syndis team (with Dropbox) reported 3 flaws in Apple #macOS, which if chained together, could have allowed sites to execute malicious code on visitors' computers

A Windows-based remote access Trojan believed to be designed by #Pakistani hacker groups to infiltrate computers and steal users' data has resurfaced after a two-year span with retooled capabilities to target #Android and #macOS devices.

https://thehackernews.com/2020/10/windows-gravityrat-malware-now-also.html

WildPressure APT campaign targeting industrial entities in the Middle East since 2019 has resurfaced with an upgraded malware toolset to attack both Windows and #macOS computers.

Read: https://thehackernews.com/2021/07/wildpressure-apt-emerges-with-new.html

North Korea-backed Lazarus Group has been observed attacking job seekers with #macOS malware that can run on Apple Macs with Intel and M1 chipsets.

Read details: https://thehackernews.com/2022/08/north-korea-hackers-spotted-targeting.html

🚨 Act now! Apple releases emergency security patches for iOS, iPadOS, #macOS, tvOS, watchOS, & Safari web browser to counter 3 new actively exploited zero-day vulnerabilities.

🔒 CVE-2023-32409
🔒 CVE-2023-28204
🔒 CVE-2023-32373

Read: https://thehackernews.com/2023/05/webkit-under-attack-apple-issues.html

Beware #macOS users! A sneaky variant of the XLoader malware hides inside an app called "OfficeNote."

Think you're boosting productivity? You might be compromising security!

Read details: https://thehackernews.com/2023/08/new-variant-of-xloader-macos-malware.html

🚨 ALERT: State-sponsored North Korean hackers are using a sneaky #macOS malware called KANDYKORN to target crypto engineers via Discord.

Learn more: https://thehackernews.com/2023/11/north-korean-hackers-tageting-crypto.html

New Malware ALERT! JaskaGO, a cross-platform threat, targets Windows and #macOS systems with a wide range of potent commands.

Learn more: https://thehackernews.com/2023/12/new-go-based-jaskago-malware-targeting.html

⚠️ Alert: A new large-scale scam by "markopolo" targets cryptocurrency users with malware-infected applications like Vortax to deliver information stealers such as Rhadamanthys, StealC, and Atomic #macOS Stealer.

🔗 Don't fall for it—get details: https://thehackernews.com/2024/06/warning-markopolos-scam-targeting.html

Cybersecurity researchers have identified a new variant of BeaverTail malware disguised as a #macOS app targeting job seekers. The malware, used by DPRK hackers, steals sensitive information and installs backdoors.

Learn more: https://thehackernews.com/2024/07/north-korean-hackers-update-beavertail.html

⚡ 25,000 U.S. businesses already use macOS, and the number keeps growing. Yet macOS threats are still flying under the radar for most security teams.

Attackers know this. 👀 And they're quietly adding more cross-platform threats to take advantage of it, targeting sensitive data.

That's exactly why #ANYRUN just levelled up. The sandbox now supports #macOS alongside #Windows, #Linux, and #Android — one unified place, full visibility, faster verdicts.

👉 Close the gap before it becomes a costly one: https://thn.news/mac-threat-analysis

⚠️ WARNING - Are you using #ChatGPT, Codex, or OpenAI Atlas browser?

Update now... Older #macOS apps will stop working after May 8, 2026 due to a supply chain attack on a dependency used in OpenAI’s signing workflow. No user data was compromised, but certificates are revoked.

🔗Read → https://thehackernews.com/2026/04/openai-revokes-macos-app-certificate.html

macOS attacks are now hiding in system features.

Payloads stored in Spotlight metadata let attackers run code without suspicious files, using native scripting and protocols to move and persist outside standard monitoring.

🔗 Learn how macOS built-ins are being weaponized → https://thehackernews.com/2026/04/threatsday-bulletin-290m-defi-hack.html#macos-stealth-execution-abuse

🛑 Google and YouTube ads are delivering FlutterShell, a new #macOS backdoor that passed Apple notarization with valid Developer IDs.

The malware can hijack Chrome traffic, run shell commands, alter files, and update its behavior from attacker servers.

Read: https://thehackernews.com/2026/06/fluttershell-backdoor-spreads-to-macos.html

This week’s cyber recap is stacked:

🌐 Chrome 0-day exploited
🏛️ Oracle PeopleSoft hit
🐧 Arch AUR packages poisoned
🔐 Check Point VPN attacks
📡 UniFi flaws exploited
🎣 Major phishing kit takedown
🤖 AI brands used as bait
🍎 #macOS fake installers
📦 npm/PyPI malware
📱 #Android adware
☁️ Cloud logging abuse risks
🕵️ RAT using Google Sheets
💾 Ransomware data exfil tricks

Plus urgent CVEs, tools, and expert webinars.

Read here: https://thehackernews.com/2026/06/weekly-recap-chrome-0-day-unifi.html

> A clean-looking GitHub repo.
> A poisoned npm package.
> A new cross-platform RAT.

Researchers found SStar Agent targeting Windows and #macOS through a fake Web3 developer take-home test.

Windows builds add keylogging, clipboard monitoring, and remote control. macOS builds focus on recon and data theft.

Read: https://thehackernews.com/2026/06/threatsday-bulletin-worm-code-leaked-ai.html#cross-platform-rat-emerges

🚨 Malware is now trying to confuse the AI tools used to analyze it.

Experts found Gaslight, a Rust-based #macOS implant linked to North Korea-aligned actors.

It embeds fake system messages to push AI-assisted triage toward aborting or refusing analysis.

See how it works: https://thehackernews.com/2026/06/new-gaslight-macos-malware-uses-prompt.html

🛑 Gaslight doesn’t just steal from #macOS.

It tries to talk the analyst’s AI tools out of analyzing it.

SentinelOne found a Rust-based implant with #Telegram C2 and 38 fake “system” messages built to make LLM-assisted triage abort or refuse.

Read: https://thehackernews.com/2026/06/new-gaslight-macos-malware-uses-prompt.html

⚠️ New Java RAT is being sold as MaaS.

QuimaRAT is built to run on Windows, #Linux, and #macOS, with encrypted plugins, OS-specific persistence, C2 rotation via Pastebin, and a browser-cache loader for staging payloads.

Read: https://thehackernews.com/2026/07/new-java-based-quimarat-maas-built-to.html

🚨 Alibaba tool users were targeted with a cross-platform RAT.

Researchers linked 18 malicious npm packages to a layered dependency chain that served Windows, #Linux, and #macOS payloads with command execution, persistence, file transfer, and lateral movement capabilities.

How the npm attack worked: https://thehackernews.com/2026/08/18-malicious-npm-packages-deliver-cross.html