All news with #apple tag

SMS Phishers Pivot to Points, Taxes and Fake Retailers

🚨 China-based phishing-as-a-service groups have deployed thousands of mobile-targeted scam domains using SMS (iMessage/RCS) lures that promise rewards points, tax refunds or bargains to harvest payment data. Sites collect name, address and card details, then request a one-time code — which fraudsters use to enroll stolen cards in Apple or Google mobile wallets. These fake e-commerce shops are advertised on major platforms and can remain active for months, making them harder to detect; reporting suspicious messages and domains to blocklists such as SURBL and threat scanners helps accelerate takedowns.

Russia Blocks FaceTime and Snapchat Citing Terror Use

📵 Russian telecom regulator Roskomnadzor has blocked FaceTime and Snapchat, alleging the platforms are being used to coordinate terrorist attacks, recruit perpetrators, and facilitate fraud against Russian citizens. Roskomnadzor said Snapchat was blocked on October 10 under centralized public communication network rules, and announced the FaceTime restriction later. Apple and Snap did not immediately respond to requests for comment.

Intellexa Continues Exploitation of Zero-Day Bugs Worldwide

🔍 Google Threat Intelligence Group (GTIG) analysis shows that Intellexa, vendor of the Predator spyware, continues to develop and deploy zero‑day exploits against mobile browsers and operating systems despite sanctions. GTIG attributes 15 unique zero‑days to Intellexa out of roughly 70 discovered since 2021, spanning RCE, sandbox escape, and LPE flaws on iOS, Android, and Chrome. The company uses modular exploit frameworks, acquires exploit chain steps from third parties, delivers payloads via one‑time messaging links and malvertising, and embeds anti‑analysis watcher modules to abort operations on detection.

Amazon EC2 M4 Max Mac instances (Preview) for Apple builds

🚀 Amazon Web Services is previewing Amazon EC2 M4 Max Mac instances, powered by the latest Mac Studio hardware to accelerate demanding Apple build and test workflows. These next-generation Mac instances target developers building for iOS, macOS, iPadOS, tvOS, watchOS, visionOS, and Safari. M4 Max offers a 16-core CPU, 40-core GPU, 16-core Neural Engine, and 128 GB unified memory, plus Nitro-based networking and EBS bandwidth to support large-scale CI/CD and testing.

Google adds Pixel-to-iPhone file sharing via Quick Share

📱 Google has made Quick Share interoperable with Apple's AirDrop, enabling two-way file transfers between Pixel devices and iPhones starting with the Pixel 10 family. The implementation uses AirDrop's "Everyone for 10 minutes" direct, device-to-device mode with no server intermediaries. Google says it applied threat modeling, internal security and privacy reviews, Rust parsing to reduce memory risks, and independent NetSPI testing. Users must manually confirm recipients before sharing.

Amazon EC2 macOS Tahoe Now Available on Mac Instances

🖥️ Amazon Web Services now publishes Apple macOS Tahoe (v26) as Amazon Machine Images (AMIs) for EC2 Mac instances, enabling developers to build and test with Xcode 26 and the latest Apple platform SDKs. These AMIs run on Apple silicon EC2 Mac instances and are backed by Amazon Elastic Block Store (EBS) for stable, high-performance storage. Images include the AWS CLI, Command Line Tools for Xcode, Amazon SSM Agent, and Homebrew with the AWS Homebrew Tap. macOS Tahoe AMIs are available in all AWS regions that offer Apple silicon Mac instances and can be launched via the Console, CLI, or API.

Phishing texts impersonate Find My to steal Apple IDs

📱 The Swiss NCSC warns of smishing attacks that impersonate Apple's Find My team, telling owners their lost iPhone has been found to lure them to a fake login page. Messages can cite device details visible on the lock screen and use the displayed contact info to target victims. The counterfeit pages request the user's Apple ID and password, which attackers then use to remove Activation Lock. Users should enable Lost Mode, avoid unsolicited links, use a dedicated contact email, and protect their SIM with a PIN.

Leading Bug Bounty Programs and Market Shifts 2025

🔒 Bug bounty programs remain a core component of security testing in 2025, drawing external researchers to identify flaws across web, mobile, AI, and critical infrastructure. Leading platforms like Bugcrowd, HackerOne, Synack and vendors such as Apple, Google, Microsoft and OpenAI have broadened scopes and increased payouts. Firms now reward full exploit chains and emphasize human-led reconnaissance over purely automated scanning. Programs also support regulatory compliance in critical sectors.

Google AI 'Big Sleep' Finds Five WebKit Flaws in Safari

🔒 Google’s AI agent Big Sleep reported five vulnerabilities in Apple’s WebKit used by Safari, including a buffer overflow, two memory-corruption issues, an unspecified crash flaw, and a use-after-free (CVE-2025-43429 through CVE-2025-43434). Apple issued patches across iOS 26.1, iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, watchOS 26.1, visionOS 26.1 and Safari 26.1. Users are advised to install the updates promptly to mitigate crash and memory-corruption risks.

CISA Adds Five Exploited Bugs Including Oracle EBS SSRF

⚠️ CISA added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, confirming CVE-2025-61884 — an SSRF in the Runtime component of Oracle E-Business Suite — is being weaponized in the wild. The agency warns CVE-2025-61884 is remotely exploitable without authentication and follows active exploitation of CVE-2025-61882, a critical RCE bug. The KEV update also includes high-severity issues in Microsoft Windows SMB Client, Kentico Xperience CMS, and Apple JavaScriptCore, and FCEB agencies must remediate them by November 10, 2025.

CISA Adds Five CVEs to Known Exploited Vulnerabilities

🚨 CISA added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2022-48503 (Apple), CVE-2025-2746 and CVE-2025-2747 (Kentico Xperience Staging Sync Server), CVE-2025-33073 (Microsoft Windows SMB Client), and CVE-2025-61884 (Oracle E-Business Suite SSRF). These flaws include authentication bypasses, improper access control, and SSRF, which are frequent attack vectors and pose significant risks. Under BOD 22-01, Federal Civilian Executive Branch agencies must remediate identified KEV items by the required due dates; CISA strongly urges all organizations to prioritize timely remediation as part of their vulnerability management practice.

Apple Raises Top Bug Bounty to $2M for Zero-Click Exploits

🔒 Apple has expanded its Security Bounty program, doubling the top award to $2,000,000 for exploit chains that achieve goals comparable to sophisticated mercenary spyware. The company says bonuses for Lockdown Mode bypasses and vulnerabilities found in beta software can push payouts past $5 million. New, higher rewards include $100,000 for a complete Gatekeeper bypass, $1,000,000 for broad unauthorized iCloud access, up to $300,000 for one-click WebKit sandbox escapes, and up to $1,000,000 for wireless proximity exploits. Apple is also introducing Target Flags, a mechanism that lets researchers demonstrate exploitability and qualify for accelerated awards processed immediately after verification, even before a fix is released.

Apple Doubles Top Bug Bounty to $2M, Bonuses Possible

🔐 Apple has increased the top award in its Apple Security Bounty program to $2m for exploit chains that emulate sophisticated mercenary spyware. Bonuses for Lockdown Mode bypasses and vulnerabilities found in beta software can more than double that payout, potentially exceeding $5m. Apple also raised many category rewards — including $100,000 for a Gatekeeper bypass and $1m for broad unauthorized iCloud access — and introduced a Target Flags initiative to speed and standardize exploitability demonstrations.

Apple doubles top RCE bounty to $2M amid new MIE security

🔒 Apple has raised its top bounty for iOS zero‑click system‑level remote code execution from $1 million to $2 million, with additional bonuses for Lockdown Mode bypasses and beta‑stage reports that can push awards above $5 million. The change coincides with the rollout of Memory Integrity Enforcement in A19/A19 Pro chips, which leverages Arm's MTE/EMTE to harden memory safety. Apple will also provide 1,000 iPhone 17 devices to civil society members at risk.

Apple Raises Zero-Click Bug Bounty to $2M in Program

🔒 Apple has expanded and redesigned its bug bounty program, doubling the top reward to $2 million for zero-click remote compromise reports and enabling bonus payouts that can push awards above $5 million. The new payout tiers raise rewards across multiple attack categories and add a $1,000 encouragement award for low-impact findings. Apple broadened the wireless-proximity category to include C1/C1X and N1 chips and plans to distribute 1,000 secured iPhone 17 devices in 2026.

How Uber Appears to Know Your Location on iOS Devices

📍 iPhone users have reported receiving airport pickup prompts from Uber even when the app’s location permission is set to Only While Using. The notifications are generated locally by iOS using Apple’s UNLocationNotificationTrigger, which fires preconfigured alerts when a device enters or exits a geofenced area. Uber does not receive location data until you open the app, but the notification’s wording can misleadingly suggest active tracking.

Leaked iPad Pro M5 Benchmark Nears Laptop CPU Performance

🔍 A leaked Geekbench entry allegedly from an unreleased iPad shows an Apple M5 chip delivering a 4,133 single‑core score and 15,437 multi‑core score, with the processor reported at 4.42 GHz and paired with 12GB of RAM and likely 256/512GB storage. In early comparisons, Apple's per‑core performance edges out Qualcomm's Snapdragon X Elite 2 in single‑thread tests, while the Snapdragon's higher core count gives it a clear multi‑core lead. The results highlight Apple's continued CPU design strength but should be treated as an unverified leak until independently confirmed.

Leaked iPad Pro M5 Benchmark Shows Significant Gains

🔍An alleged Apple M5 benchmark for an iPad Pro has surfaced on Geekbench, reporting a single-core score of 4,133 and a multi-core score of 15,437 for a variant clocked at about 4.42 GHz. The listing shows 12 GB of RAM, likely paired with 256 GB or 512 GB of storage. Early comparisons place the M5 narrowly ahead in single-thread tests versus Qualcomm's Snapdragon X Elite 2 but behind in multi-core throughput, underscoring Apple's strong per-core design.

ThreatsDay Bulletin: Exploits Target Cars, Cloud, Browsers

🔔 From unpatched vehicles to hijacked clouds, this ThreatsDay bulletin outlines active threats and defensive moves across endpoints, cloud, browsers, and vehicles. Observers reported internet-wide scans exploiting PAN-OS GlobalProtect (CVE-2024-3400) and campaigns that use weak MS‑SQL credentials to deploy XiebroC2 for persistent access. New AirBorne CarPlay/iAP2 flaws can chain to take over Apple CarPlay in some cases without user interaction, while attackers quietly poison browser preferences to sideload malicious extensions. On defence, Google announced AI-driven ransomware detection for Drive and Microsoft plans an Edge revocation feature to curb sideloaded threats.

GitHub Pages SEO Poisoning Delivers Atomic Stealer

🚨 Attackers are creating convincing GitHub Pages that impersonate well-known brands to trick macOS users into installing the Atomic infostealer. Using SEO poisoning, malicious repositories are promoted in search results and funnel victims through multiple redirects to pages that instruct users to paste a Terminal curl command. That command decodes a base64 URL and executes a script that fetches and runs the Atomic payload. LastPass published IoCs and requested takedowns, but warns the campaign remains active.