CloudSyncD: fake Zoom installer backdoors macOS, steals passwords
Jamf Threat Labs found CloudSyncD, a new macOS backdoor delivered by a fake Zoom installer that social-engineers past Gatekeeper and hides the user's password in a fake config file.
Stories tagged: #macos
Apple patches exploited CoreGraphics zero-day (CVE-2026-86950)
Apple shipped iOS/iPadOS 26.7.1 and macOS 15.8.1/26.7.1 for CVE-2026-86950, a CoreGraphics out-of-bounds write used in targeted attacks and reported by Meta.
macOS.Gaslight: DPRK Rust implant attacks LLM-based malware triage
SentinelLABS named macOS.Gaslight on June 23 — a Rust backdoor whose 3.5 KB prompt-injection payload is built to make an AI triage agent abort the analysis.