Apple
Apple security: macOS malware, browser vulnerabilities and attacks on Apple devices and development tools. Compare the affected products, updates and reported evidence.
Latest report:
Matching reports 23
-
CISA flags exploited Apple pointer authentication bypass
CISA flags exploited Apple pointer authentication bypass
-
Fake Padre app removed as Iris traces $23,000 in thefts
Fake Padre app removed as Iris traces $23,000 in thefts
-
Anthropic says unreleased AI built five exploit chains in tests
Anthropic says unreleased AI built five exploit chains in tests
-
Tor relay hijacking exposed SSH passwords; Heartbreaker ransomware attempts to recompile itself
Tor relay hijacking exposed SSH passwords; Heartbreaker ransomware attempts to recompile itself
-
Fake Zoom Installer Uses CloudSyncD to Establish Persistent Access on Macs
Fake Zoom installer tricks Mac users into granting root access to install CloudSyncD backdoor for persistent control and follow-on payloads.
-
Apple Plans a More Deliberate Consent Step for Mac’s Full Disk Access
Apple plans explicit consent for Mac Full Disk Access amid AI agent risks, covering files, mail and messages; no timeline or macOS version yet.
-
Public CoreGraphics PoC Raises Pressure to Patch Apple Devices Under Targeted Attack
Public PoC for CVE-2026-86950 confirms CoreGraphics font crash, raising pressure to patch iOS 26.7.1 and macOS amid targeted attacks.
-
Apple Closes CoreGraphics Memory Flaw Linked to Precision iPhone Attacks
Apple patched CVE-2026-86950, a CoreGraphics out-of-bounds flaw enabling code execution in targeted iPhone attacks. Update iOS 26.7.1 and macOS now.
-
PamStealer Makes macOS Payload Recovery Depend on Its Command Server
New PamStealer macOS variant uses fake Wavel wallet, JXA-to-zsh chain and server-side X25519 decryption to deliver Swift password stealer.
-
WeChat Zero-Click Worm Hijacked Accounts Through Incoming Calls
A zero-click WeChat flaw let contacts hijack accounts via incoming calls and spread as a worm. Fixed in August updates with server-side blocking.
-
Pegasus Hits Serbia’s Student Movement with a Zero-Click iMessage Exploit
Citizen Lab confirmed Pegasus zero-click iMessage compromise of Serbian student activist's iPhone, amid 14 spyware targets and NoviSpy Android cases.
-
AnonyMousKIT, the Phishing-as-a-Service Using AI Voices to Steal iPhone Passcodes
SOCRadar reveals AnonyMousKIT, a PhaaS using AI voices to phish iPhone owners for passcodes, bypassing Activation Lock and stealing data.
How this coverage is selected
Articles are selected by explicit entity names or reviewed aliases in their original headlines, within the last 365 days. This is a chronology of our reporting, not a complete incident history. Separate stories do not imply a shared attack campaign. Read each article for its sources, affected versions and uncertainties.