3 casos · pág. 1/1
On 24 September 2026, GreyNoise observed a malicious actor using 149.104.78.141 to attempt pre-disclosure zero-day exploitation of a Citrix NetScaler Gateway on a Project Swarm participant sensor. No CVE-specific detections existed at the time, but behavioral detections labeled the activity malicious within seconds. The attempt failed to …
Unit 42 analyzed an Atomic macOS (AMOS) stealer infection generated in a lab on Aug. 5, 2026, starting from a fake "macOS toolkit" instruction page hosted at getmacouscloud.com. The page tells victims to paste a command into Terminal, a ClickFix-style copy/paste technique, which downloads a Zsh script and then installs a Mach-O AMOS paylo…
Kaspersky researchers describe a new MacSync macOS infostealer variant, first seen in the wild in September 2026, that replaces the earlier AppleScript-based droppers with FAT Mach-O binaries written in Objective-C and Swift. MacSync is sold as malware-as-a-service, so delivery varies by operator. In this campaign it spread through malici…
