Apple released updates for a zero-day it says was used in extremely sophisticated targeted attacks against specific individuals on iOS versions before iOS 27. Tracked as CVE-2026-20700, the flaw is an out-of-bounds write in CoreGraphics, the framework for two-dimensional graphics, image rendering, and text drawing across iOS, macOS, iPadOS, watchOS, and tvOS, and was reported by Meta Product Security. Processing a maliciously crafted file can lead to arbitrary code execution, and Apple addressed it with improved bounds checking. The affected device list is broad, spanning iPhone 11 and later, many iPad models, and Macs running macOS Sequoia 15.8.1 and Tahoe 26.7.1. Apple did not attribute the attacks or name the targeted individuals.
Jamf Threat Labs flagged a new version of the PamStealer macOS infostealer that can only be unpacked with the attacker's server. Earlier variants embedded payload key material directly in the JavaScript for Automation dropper, but the latest completes a key exchange with the server before the payload unwraps, so it cannot be recovered from a static sample alone. The lure also changed: where July and August versions impersonated the Maccy, Scoppr, and Nancy Clipboard apps, victims are now drawn to a fake site advertising a non-existent cryptocurrency wallet called Wavel. Clicking Download for macOS retrieves a disk image whose AppleScript opens Script Editor with instructions to run the dropper.
Docker patched two flaws in Docker Sandboxes, the isolated micro-VM environments used to run untrusted code and AI-agent tasks, that let malicious guest code break out and read or modify files on the macOS host. The more serious, CVE-2026-77179 and scored 9.4, is in the file-sharing component: the host improperly follows symbolic links when reopening a file, so a guest can swap a directory for a symlink after a path is approved, escape the shared workspace, and touch arbitrary host files as the account running the VM, potentially leading to host code execution. A second flaw abuses the guest-to-host socket relay the same way. Both are fixed in version 0.42.0.
Researchers at JFrog disclosed a flaw in Parallels Desktop, which runs Windows and Linux virtual machines on a Mac, that lets a non-administrator user gain root on the Mac itself. Tracked as CVE-2026-90894 and named ParaShells, the issue is that Parallels' root-level background service listens on a socket that was left world-writable, so any program running as a normal user can connect to it and escalate to root. It needs code already running locally, not network access. The fix is in Parallels Desktop 27, but Intel Macs cannot install that version, leaving those users without a patch. Apple-silicon users should update to the latest release on that line.
The Netherlands cyber agency warned that attackers are exploiting a recently patched macOS flaw to gain root on internet-exposed Macs and install cryptocurrency miners. Tracked as CVE-2026-65400 and scored 9.8, the authentication flaw in the Screen Sharing component lets a network attacker authenticate to the built-in remote desktop service, which uses VNC on port 5900, without valid credentials due to flawed state management. Apple fixed it in emergency updates on August 6 for macOS Tahoe, Sequoia, and Sonoma. Screen Sharing is off by default, but any Mac with it enabled and reachable from the internet is at high risk, and several have already been compromised to run Monero miners.
Jamf detailed a new macOS information stealer, AmnesiaStealer, spread through ClickFix lures that trick users into running a command from a fake download page. Beyond harvesting the login password, keychain, browser data, and cryptocurrency wallets, it includes a module that clones the victim's Chromium browser profile, including its logged-in state, into a hidden browser on the infected Mac and gives the attacker live remote control of it through the browser's debugging protocol. Because the session runs on the victim's own device with their real identifiers, this lets the attacker use authenticated accounts while sidestepping multi-factor authentication. Jamf calls it the first macOS malware to combine profile cloning with live remote browser control.
Microsoft Threat Intelligence detailed a macOS ClickFix operation spanning more than 250 domains that now fingerprints visitors before deciding whether to show a malware lure. The server-side gate hides the malicious page from crawlers and sandboxes while presenting selected Mac users with a fake software download, an anti-analysis layer rather than a change to the attack itself. The lure still requires the victim to copy and run an obfuscated command in Terminal, which fetches scripts and installs an infostealer, in this case Atomic Stealer, that targets credentials, browser data, authentication stores, and cryptocurrency wallets. Many domains follow a dictionary-word naming pattern using the word file.
Palo Alto Networks Unit 42 detailed a rebuilt version of XCSSET, macOS malware that spreads through Xcode developer projects. The actors compromise Git repositories and inject a downloader into ordinary files inside a project, so that when a developer builds the cloned project, a hidden loader runs under their own account with no permission prompt. It then infects every other Xcode project on the machine and propagates through shared code. Version 40 hides its logic in memory, generates polymorphic payloads, and adds a Chrome hijacker that drives the browser through its debugging protocol plus a component that trojanizes Telegram. Seventeen modules handle credential, keystroke, clipboard, and browser theft.
Group-IB detailed ClickLock, a macOS infostealer that coerces victims into handing over their login password. It arrives when a user is tricked into pasting a command into Terminal from a fake verification page, then shows a fake system dialog asking for the password. If the victim refuses, ClickLock begins killing core apps like Finder, the Dock, and browsers every 210 milliseconds, leaving only a password box on an unusable desktop, while also suppressing security notifications. Once the password is entered, it steals the Keychain, browser credentials, and cryptocurrency wallets and sends them to a Telegram bot. Group-IB counted at least 100 targets across 33 countries, over half in Europe.
Jamf detailed CrashStealer, a macOS infostealer delivered through a signed, Apple-notarized app called Werkbit that passes Gatekeeper, since it carried a valid developer ID before Apple revoked it. Distributed as a disk image and gated behind a meeting PIN so it is served only to targeted visitors, the malware validates the victim's login password locally, then harvests broadly from browsers, cryptocurrency wallets, password managers, and the keychain, encrypting the loot before sending it out. It persists by copying and re-signing itself. There is no zero-click stage: a victim still runs the app and enters their password, but the notarized delivery and careful targeting make it more convincing than typical Mac stealers.
TrustStrike Labs