- \n
- A new crypto-stealing tool bypassed Apple\u2019s protections.<\/li>\n
- Hackers gained access to thousands of GitHub repositories.<\/li>\n
- Interpol made large-scale arrests in the Middle East and North Africa.<\/li>\n
- A critical flaw was found in ChromaDB, a database for AI developers.<\/li>\n<\/ul>\n<\/div>\n
New crypto-stealing malware bypasses Apple protections<\/h2>\n
The new infostealer Reaper bypasses macOS protections by using a fake security update prompt. It targets browser secrets and crypto wallets. Researchers at SentinelOne<\/a> reported the threat.<\/p>\n
Unlike earlier attacks using an initial SHub build that relied on ClickFix<\/a>, the new campaign uses a special applescript:\/\/ link. Following it automatically opens macOS\u2019s built-in script editor and executes malicious code.<\/p>\n
According to SentinelOne, the attackers spread the malware via fake installers for WeChat and Miro. Some lookalike domains spoofing Microsoft and QQ remained active at publication.<\/p>\n
Before invoking AppleScript, the malicious sites fingerprint the visitor\u2019s device to filter out researchers and terminals with Russian locales. The code checks for virtual machines and VPNs, as well as installed browser extensions for password managers and crypto wallets. All data is exfiltrated to the attacker via a Telegram bot.<\/p>\n
After launch, the user sees a fake Apple update notification. The programme downloads a shell script and prompts for the macOS password.<\/p>\n
![\"SHub_reaper_9\"](\"https:\/\/forklog.com\/wp-content\/uploads\/img-b81cd53c62ff07a9-5083360139745133.webp\")
Password prompt. Source: SentinelOne.\u00a0<\/figcaption><\/figure>\n The infostealer then targets:<\/p>\n
- \n
- data from Google Chrome, Mozilla Firefox, Brave, Microsoft Edge, Opera, Vivaldi, Arc and Orion;<\/li>\n
- browser extensions of crypto wallets, including MetaMask and Phantom;<\/li>\n
- browser extensions of the 1Password, Bitwarden and LastPass password managers;<\/li>\n
- desktop cryptocurrency wallet apps, including Exodus, Atomic Wallet, Ledger Live, Electrum and Trezor Suite;<\/li>\n
- iCloud and Telegram account data;<\/li>\n
- configuration files related to programming.<\/li>\n<\/ul>\n
![\"image\"](\"https:\/\/forklog.com\/wp-content\/uploads\/img-438dff466a25440d-5083025245275949.webp\")
Searching for browser password managers and crypto wallets. Source: SentinelOne.<\/figcaption><\/figure>\n Reaper also includes a Filegrabber module that searches the desktop and Documents folder for file types likely to contain sensitive information. It collects target files smaller than 2 MB (or up to 6 MB for PNG images), with a total data cap of 150 MB.<\/p>\n
Researchers warned the malware persists on the system, masquerading as Google updates.<\/p>\n
SentinelOne stressed that SHub operators are expanding the stealer\u2019s capabilities by adding remote-access functions to compromised devices, enabling additional payload delivery in future.<\/p>\n
Hackers gained access to thousands of GitHub repositories\u00a0<\/h2>\n
On 19 May hackers breached 3,800 internal GitHub repositories, accessing them via a malicious extension for the VS Code editor. The incident was disclosed<\/a> by the company\u2019s chief information security officer, Alexis Wales.<\/p>\n
The breach occurred after a GitHub employee installed a tainted version of the popular Nx Console plugin (version 18.95.0). The malicious code aimed to steal developer credentials and secrets for cloud platforms, including AWS<\/span>, Kubernetes, GitHub and Docker.<\/p>\n
The cybercriminal group TeamPCP claimed responsibility. They listed the stolen code for sale on the Breached forum, asking at least $50,000. The group had previously been linked to attacks on Mistral AI, UiPath, OpenSearch and OpenAI staff.<\/p>\n
The Nx Console developers explained<\/a> that one of their own employees had earlier fallen victim to a supply-chain attack on the TanStack npm packages. Through the GitHub CLI utility, the hackers stole his tokens, logged into his work account and injected malicious code into the extension update.<\/p>\n
The infected version of Nx Console was available in the Visual Studio Marketplace for only 18 minutes (and 36 minutes on OpenVSX). Fewer than 70 downloads occurred in that time.<\/p>\n
GitHub said it swiftly isolated the compromised device and performed an emergency rotation of all critical secrets and access keys.<\/p>\n
Interpol made large-scale arrests in the Middle East and North Africa<\/h2>\n
Law enforcement from 13 Middle Eastern and North African countries arrested 201 suspects during Operation Ramz, aimed at combating cybercrime, Interpol<\/a> said.<\/p>\n
During the operation, the identities of 382 suspects were established in Algeria, Bahrain, Egypt, Iraq, Jordan, Lebanon, Libya, Morocco, the UAE, Oman, Palestine, Qatar and Tunisia.<\/p>\n
Authorities also seized 53 servers used for phishing, malware distribution and online fraud. Analysis of the data taken from this equipment showed 3,867 victims.<\/p>\n
To track the hacker infrastructure, Interpol engaged private cybersecurity firms, including Kaspersky Lab, Group-IB, The Shadowserver Foundation, Team Cymru and TrendAI.<\/p>\n
A critical vulnerability found in the ChromaDB database for AI developers<\/h2>\n
A top-severity critical vulnerability was found in ChromaDB, a database widely used to build AI applications, according to HiddenLayer.<\/a><\/p>\n
ChromaDB is an open-source vector database and retrieval backend heavily used in agentic AI systems and related applications.<\/p>\n
According to HiddenLayer, the flaw affects the Python version of the API<\/span> (based on FastAPI) and stems from broken security checks. Upon receiving a request, the system first downloads and executes the specified ML<\/span> model (for example, a malicious payload from Hugging Face), and only then verifies the user\u2019s authenticity. The server duly returns an authorisation error, but by that time the attacker\u2019s code has already executed.<\/p>\n
The researchers estimate that about 73% of Chroma nodes run vulnerable versions. Local builds and projects using the Rust frontend are not at risk. The ChromaDB team is ignoring the researchers\u2019 requests, and it is currently unclear whether the vulnerability has been fixed in the latest 1.5.9 release.<\/p>\n
Pending official guidance and patches, experts advised users to:<\/p>\n
- \n
- isolate the Python server from public access (restrict access to the API port via a firewall);<\/li>\n
- use the Rust frontend as an alternative for exposed environments;<\/li>\n
- carefully vet third-party ML models for backdoors before running them, especially if trust in remote code is enabled.<\/li>\n<\/ul>\n
Europol dismantled First VPN over criminal use<\/h2>\n
Law enforcement disabled the First VPN service, which was used for extortion and data theft. The international operation was announced by Europol<\/a>.<\/p>\n
According to police, the service was advertised on hacker forums as a privacy-focused tool that kept no user activity logs and ignored law-enforcement requests. First VPN was named in virtually every major cybercrime case supported by the agency.<\/p>\n
The investigation began in December 2021 under the leadership of authorities in France and the Netherlands. At one stage, agents infiltrated the VPN\u2019s infrastructure, built a user database and identified connections used by hackers.<\/p>\n
As a result of the 19\u201320 May operation, core infrastructure was disrupted. Officers seized 33 servers in 27 countries, confiscated domains, arrested the administrator and searched a suspect\u2019s home in Ukraine.<\/p>\n
Also on ForkLog:<\/p>\n
- \n
- Polymarket confirmed<\/a> a private key compromise.<\/li>\n
- The MAPO token fell<\/a> 96% after a hack.<\/li>\n
- Media: the Pentagon created<\/a> a group to deploy hacking AI models.<\/li>\n
- Opinion: AI and quantum technologies will put<\/a> existing security systems at risk.<\/li>\n
- The BTCFi protocol Echo was hacked<\/a> for $816,000.<\/li>\n
- Hackers drained<\/a> $11.5 million from the Verus protocol.<\/li>\n
- The THORChain team disclosed<\/a> details of a $10 million hack.<\/li>\n<\/ul>\n
What to read this weekend?<\/h2>\n
In a new piece, ForkLog explains how to try AI models that work without an internet connection for free and which resources to use as a beginner.<\/p>\n","protected":false},"excerpt":{"rendered":"
We\u2019ve compiled the week\u2019s key cybersecurity news.<\/p>\n","protected":false},"author":1,"featured_media":97372,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"This week: macOS malware, a GitHub breach, Interpol arrests, and a critical ChromaDB flaw.","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1238,1233],"class_list":["post-97371","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-cybersecurity-digest","tag-industry-digests"],"aioseo_notices":[],"amp_enabled":true,"views":"19","promo_type":"1","layout_type":"1","short_excerpt":"This week: macOS malware, a GitHub breach, Interpol arrests, and a critical ChromaDB flaw.","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/97371","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=97371"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/97371\/revisions"}],"predecessor-version":[{"id":97373,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/97371\/revisions\/97373"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/97372"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=97371"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=97371"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=97371"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- The MAPO token fell<\/a> 96% after a hack.<\/li>\n
- Polymarket confirmed<\/a> a private key compromise.<\/li>\n