VulnHub

A new exploit kit called 'Darksword' is being used to target iPhones, particularly affecting users of cryptocurrency wallet applications. This exploit allows attackers to steal various personal information from compromised devices. The existence of Darksword raises significant concerns, especially for those who handle sensitive financial data on their mobile devices. As users increasingly rely on their phones for managing cryptocurrencies, the risk of falling victim to such attacks is growing. It’s crucial for iPhone users to stay vigilant and ensure their devices are updated to protect against these vulnerabilities.

Recent ClickFix campaigns are targeting macOS users through malicious tools disguised as ChatGPT applications. Attackers are utilizing deceptive tactics, including fake software and Terminal commands, to install the MacSync infostealer on infected systems. This infostealer is designed to harvest sensitive information from users, which poses a significant risk to personal and organizational security. Users who inadvertently download these fake tools could find their data compromised, leading to potential identity theft or financial loss. It's crucial for macOS users to remain vigilant and avoid downloading software from untrusted sources.

Researchers have identified a fraudulent website mimicking CleanMyMac that employs a ClickFix attack to install SHub Stealer malware on macOS devices. This malicious software is designed to steal sensitive information, including passwords and cryptocurrency wallet data. Users who unknowingly download this malware may face significant risks to their personal and financial security. The incident serves as a reminder for macOS users to be cautious about where they download software and to verify the authenticity of websites before entering any personal information. Ensuring that systems are protected with up-to-date security measures is crucial in preventing such attacks.

The Cybersecurity and Infrastructure Security Agency (CISA) has alerted U.S. federal agencies to address three critical security flaws in iOS that have been exploited in cyberespionage and cryptocurrency theft. These vulnerabilities are being targeted through the Coruna exploit kit, which has been linked to recent attacks. Federal agencies are urged to implement patches promptly to protect sensitive information and financial assets. The exploitation of these flaws poses serious risks, potentially allowing attackers to gain unauthorized access to devices and data. Swift action is essential to mitigate these threats and secure federal systems.

The Coruna exploit kit has been identified as a significant threat targeting older iPhones, specifically those running iOS versions from 13.0 to 17.2.1. Cybercriminals are using this toolkit to steal financial data from users, which raises concerns about the safety of personal and financial information on these devices. Researchers have noted that this multi-stage campaign is particularly aimed at exploiting vulnerabilities in outdated operating systems, making it crucial for users to stay updated. With many individuals still using older iPhone models, the risks associated with this exploit are substantial. Users are urged to upgrade their devices to the latest iOS version to protect against these attacks.

The latest Security Affairs Malware newsletter covers several significant malware threats that have emerged recently. Notably, a group identified as Stan Ghouls is targeting users in Russia and Uzbekistan using the NetSupport Remote Access Trojan (RAT), which allows attackers to control infected systems remotely. Another concerning development is the discovery of ZeroDayRAT, a new spyware designed to infiltrate both Android and iOS devices. Additionally, researchers have uncovered a Linux botnet named SSHStalker, which utilizes old-school IRC methods to compromise new victims. These activities demonstrate the evolving tactics of cybercriminals and emphasize the need for users and organizations to remain vigilant against these persistent threats.

Apple has addressed a serious zero-day vulnerability, identified as CVE-2026-20700, which was used in targeted attacks last year. This flaw, a memory corruption issue in the dyld component of Apple's operating systems, could allow attackers to execute arbitrary code on affected devices. Specifically, the vulnerability impacts versions of iOS prior to iOS 26 and was reportedly exploited in sophisticated attacks against select individuals. Users of these older versions should update their devices to protect against potential exploitation.

A North Korea-associated hacking group known as UNC1069 is targeting cryptocurrency organizations to steal sensitive information from both Windows and macOS systems. Their approach involves social engineering tactics, including the use of a compromised Telegram account to set up a fake Zoom meeting. This deception leads victims to download malware through a method called ClickFix, which researchers believe may also utilize AI-generated content to enhance its effectiveness. The implications of these attacks are significant, as they not only threaten the financial security of targeted companies but also highlight the evolving tactics used by cybercriminals in the cryptocurrency sector. Protecting against such sophisticated schemes is increasingly critical for organizations in this space.

Researchers have identified a new spyware kit called ZeroDayRAT, which is being distributed via Telegram. This toolkit is said to allow attackers to fully compromise both iOS and Android devices, functioning at a level typically associated with resources available to nation-states. The implications of this spyware are significant, as it can potentially give hackers complete access to personal data and device controls. Users of mobile devices, especially those who may be targeted for sensitive information, should be particularly cautious. The emergence of such advanced tools raises serious concerns about mobile security and privacy.

A new strain of malware known as GlassWorm has been found targeting macOS systems through compromised OpenVSX extensions. This malware aims to steal sensitive information, including passwords, cryptocurrency wallet data, and developer credentials. Users who have installed these extensions may be at risk, highlighting a significant security issue for developers and crypto users on macOS. Researchers emphasize the importance of vigilance when installing third-party extensions and recommend that users ensure their software is up-to-date. This incident underscores the need for better security practices in the software development ecosystem to prevent such attacks.

North Korean hackers are targeting macOS developers by luring them to malicious projects on GitHub and GitLab that are opened with Visual Studio Code. The attackers use these repositories to trick users into executing harmful code, potentially compromising their systems. This tactic poses a significant risk to developers who may unknowingly download and run these malicious projects, which could lead to data breaches or further exploitation of their systems. As these attacks exploit popular development tools, developers need to be vigilant about the sources of the projects they access. This incident emphasizes the ongoing threat posed by state-sponsored hackers and the need for heightened awareness in the software development community.