Vendor

Apple

Vulnerabilities and malware affecting Apple's platforms — macOS, iOS, iPadOS, and Safari — including PAM-abusing stealers, cross-platform RATs, and the Mac-native malware families that have moved from novelty to fixture in enterprise threat models.

CVEs

CVE-2024-27822

[ HIGH ] CVSS 7.8 patched

macOS PackageKit LPE via ~/.zshenv sourced under installer root context

macOS PackageKit runs PKG-installer shebang scripts under root, and zsh shebangs source ~/.zshenv from the calling user's home before the script body runs, yielding local privilege escalation. Fixed in macOS Sonoma 14.5 (May 2024).

Apple / macOS PackageKit (Installer.app framework) May 14, 2024

Articles

~/articles/2026-07-13-jamf-crashstealer-werkbit-notarized-macos-stealer

apple

Notarized Werkbit.app carries CrashStealer past Gatekeeper

Jamf flagged CrashStealer, a native-C++ macOS infostealer arriving inside Werkbit.app — Apple-notarized and gated behind a meeting PIN.

Jul 13 read →