Apple

Read

Thala

Former Binance CEO Changpeng ‘CZ’ Zhao has warned the crypto community about a new exploit targeting Mac users powered by Intel chips, which could potentially expose a user’s digital assets.
Zhao highlighted the zero-day exploit on Nov. 19, <a href="https://x.com/cz_binance/status/1859287351757078958" target="_blank" rel="noopener noreferrer nofollow">urging</a> Intel-based Mac users to patch their systems to prevent falling victim to ongoing exploits. The vulnerabilities, which also impact <a href="https://x.com/cz_binance/status/1859491329090215953" target="_blank" rel="noopener noreferrer nofollow">iPhones and iPads</a>, have been actively exploited on Mac systems, prompting Apple to release emergency fixes.
“If you use a MacBook with an Intel-based chip, Update asap!” Zhao wrote, cautioning the crypto community about potential risks to sensitive data.
Zero-day vulnerabilities are bugs discovered and exploited by hackers before a patch is available. Hence the name, as developers have “zero days” to address the issue, leaving users vulnerable until updates are installed.
According to a <a href="https://support.apple.com/en-us/121753" target="_blank" rel="noopener noreferrer nofollow">postmortem</a> from Apple, the vulnerabilities, tracked as CVE-2024-44308 and CVE-2024-44309, affect the JavaScriptCore and WebKit components of macOS Sequoia. Hackers can leverage this to execute “cross-site scripting attacks” and stealthily run malicious code.
Cross-site scripting attacks are a type of security vulnerability where attackers inject malicious scripts into trusted websites or applications. These scripts run in the browser of a user visiting the compromised site, allowing attackers to hijack user sessions, redirect users to malicious sites, and steal sensitive information.
You might also like: <a rel="noopener noreferrer nofollow" href="https://crypto.news/thala-protocol-resumes-operations-after-25-5m-exploit/"> Thala protocol resumes operations after $25.5m exploit </a>
Crypto hackers have long exploited similar vulnerabilities across both Mac and Windows systems to <a href="https://crypto.news/kaspersky-warns-of-new-macos-malware-aiming-at-crypto-wallets/" target="_blank" rel="noopener noreferrer nofollow">steal wallet credentials</a>, execute phishing scams, or <a href="https://crypto.news/crypto-clipping-malware-styx-stealer-targets-windows-computers/" target="_blank" rel="noopener noreferrer nofollow">inject malware</a> to siphon private keys and digital assets.
The tech giant reported one of the vulnerabilities as a cookie management issue, which has since been resolved with “improved state management.” At the same time, the other was addressed with “improved checks,” the report added.
The vulnerabilities were first discovered by researchers at Google’s Threat Analysis Group, known for investigating government-backed cyberattacks. As such, speculations have emerged about the potential involvement of <a href="https://crypto.news/north-korea-targets-blockchain-engineers-with-new-macos-malware/" target="_blank" rel="noopener noreferrer nofollow">state-sponsored actors</a>.
Apple hasn’t disclosed any details regarding the extent of the damage other than the fact that the vulnerabilities have been “actively exploited.”
<h2 class="wp-block-heading" id="apple-users-at-risk">Apple users at risk</h2>
Apple users, despite the company’s strong security reputation, have found themselves at risk on several occasions this year alone. On Nov. 12, North Korean hackers <a href="https://www.jamf.com/blog/jamf-threat-labs-apt-actors-embed-malware-within-macos-flutter-applications/" target="_blank" rel="noopener noreferrer nofollow">targeted</a> macOS users with crypto-focused malware capable of evading Apple’s security measures on outdated systems.
In April, web3 wallet provider Trust Wallet <a href="https://crypto.news/trust-wallet-warns-apple-ios-users-of-imessage-vulnerability/" target="_blank" rel="noopener noreferrer nofollow">issued a warning</a> about another zero-day exploit in Apple’s iMessage framework, which allowed attackers to infiltrate iPhones without any user interaction.&nbsp;
A month before, researchers <a href="https://crypto.news/apple-draws-crypto-criticism-again-what-you-need-to-know/" target="_blank" rel="noopener noreferrer nofollow">discovered a flaw</a> in Apple’s M-series chips that could be exploited to extract cryptographic keys residing in the CPU’s cache, leaving sensitive data susceptible to compromise.
Further, attackers have also managed to infiltrate the App Store several times, despite Apple’s stringent policies, to promote malicious apps that impersonate prominent <a href="https://crypto.news/bitcoin-wallet-unisat-fake-apple-ios-app/" target="_blank" rel="noopener noreferrer nofollow">crypto exchanges</a>, <a href="https://crypto.news/fake-rabby-wallet-sneaks-into-apples-app-store/" target="_blank" rel="noopener noreferrer nofollow">wallets</a>, and other <a href="https://crypto.news/apple-app-store-and-google-play-allegedly-infested-with-crypto-fraud-apps/" target="_blank" rel="noopener noreferrer nofollow">fraudulent platforms</a> that siphon a user’s crypto assets.
Read more: <a rel="noopener noreferrer nofollow" href="https://crypto.news/tapioca-foundation-offers-1m-bounty-to-attacker-after-4-7m-exploit/"> Tapioca Foundation offers $1m bounty to attacker after $4.7m exploit </a>

CZ warns crypto community of new exploit targeting macOS and iPhone users

Table of Contents

crypto.news

Other articles published on Nov 21, 2024

JPY is ‘backed by hostages’ — crypto exec Koji Higashi

Top Chinese Crypto Advocate Expelled from Party for Corruption

South Korea Bans Bitcoin ETFs, Restricts Crypto-Related Funds

Suiruto Presale Gains Momentum as SUI Investors Rally Behind the $SHIN Token

As Bitcoin Races From Record to Record, What's the Latest on Spot Bitcoin and Ethereum ETFs? Here...

Ethereum Dips Against Bitcoin: Who’s Capitalizing on This Market Shift?

Join our free newsletter for daily crypto updates!