A new way to exploit MacOS users with Intel processors warns the crypto community in a newly discovered exploit by Changpeng ‘CZ’ Zhao, the former CEO of Binance. Given its danger, the exploit actively targets Mac, iPhone, and iPad computers and destroys the users’ digital assets and personal data.
Zhao tweeted on November 19, to Mac users that hackers can use a zero-day vulnerability to steal sensitive information. He urged you to update yours immediately if you are using an Intel-powered MacBook: “Update ASAP if you use a MacBook with an Intel-based chip.” That’s why, Zhao wrote, the situation was urgent.
Such are zero-day vulnerabilities for example, that attackers exploit before the developers have the opportunity to put out a patch. Users are exposed to the attacks until an official update is made available.
Security Flaw in macOS Sequoia Exposes Users to Increased Risk of Cryptocurrency Theft
According to a postmortem from Apple, both vulnerabilities were discovered in the JavaScriptCore and WebKit components of macOS Sequoia and are being tracked as CVE-2024-44308 and CVE-2024-44309. Apple said these weaknesses could be exploited by Cross-Site Scripting (XSS) attacks that inject malicious scripts into trusted websites or applications. When run in a user’s browser on the browser of a user visiting a compromised site, attackers can steal sensitive data such as cryptocurrency credentials, hijack sessions, and redirect users to harmful websites.
Since then, Apple has issued emergency patches to address those flaws, but experts warn that users should move quickly to avoid becoming victims of active exploits.
The detection of these vulnerabilities is fresh on the heels of numerous other Apple device cyber security threats. North Korean hackers launched a crypto-themed malware attack targeting macOS users by targeting vulnerabilities on outdated systems earlier this month. In April, Apple also faced another serious problem as web3 wallet provider Trust Wallet warned of an exploit in the iMessage framework wherein attackers could enter iPhones without user interaction.
State-Sponsored Actors Suspected in Apple Vulnerabilities Targeting Crypto
While Apple has been tight-lipped about the damage these vulnerabilities caused to the company, it has confirmed that hackers have been actively exploiting them. The growing speculation is that state-sponsored actors were behind the attacks. However, Google’s Threat Analysis Group, which discovered the flaws, is well known for its research into cyberattacks involving government-backed actors.
This incident occurred independently this year in a string of Apple device breaches. Attackers have also successfully exploited vulnerabilities in macOS and iPhones and infringed the App Store to promote malicious apps that pretend to be cryptocurrency exchanges or wallets, rendering customers’ crypto assets unsafe.
This news is republished from another source. You can check the original article here
