macOS

Kaspersky Premium for macOS Gains App Uninstall Feature to Remove Residual Files

Kaspersky Premium now includes an App Uninstall tool for macOS that locates and deletes leftover files such as caches, cookies, settings, and logs after applications are removed. The feature also identifies duplicate copies of programs and lets users remove all instances or select specific ones while preserving shared components used by other software. Survey data from Kaspersky shows that only 44 percent of macOS users delete unused applications, even though 56 percent regularly clear browser data and 54 percent remove unwanted media files. Residual files can contain sensitive information including account tokens, passwords, IP addresses, event logs, and personal documents, creating privacy risks especially when a device is sold or accessed by unauthorized parties. Deleted files can be restored from the trash or directly within Kaspersky Premium before the application session ends. The company also warns that malicious programs are frequently disguised as legitimate macOS cleaning utilities.

Corporate Wi-Fi Passwords Stored in Plain Text on Every Connected Device

Many organizations continue to rely on a single shared password for corporate and guest Wi-Fi networks, creating long-term access risks after employees leave. On Windows systems, the netsh wlan show profile command reveals the password in clear text without requiring administrative rights. Linux distributions using NetworkManager store the PSK in readable files under /etc/NetworkManager/system-connections unless the keyring option is selected. macOS keeps passwords in the Keychain, which prompts for user confirmation before disclosure. The article explains why shared passwords cannot serve as effective access control and recommends WPA2/WPA3-Enterprise authentication or properly isolated guest networks instead. It also provides concrete commands for administrators to audit their own environments and highlights the consequences of infrequent password rotation.

AmnesiaStealer Malware for macOS Hijacks Authenticated Browser Sessions via ClickFix and Chromium

A new macOS malware strain named AmnesiaStealer has emerged that combines infostealing, persistence mechanisms, and the ability to silently take over already authenticated browser sessions. The infection chain begins with a fake GitHub page that tricks victims into copying a malicious command into Terminal using the ClickFix social engineering technique. Once executed, the Rust-based payload collects system data, displays a fake installer window to capture the user password, and attempts to unlock the Keychain for protected credentials. Targeted data includes browser cookies, history, extensions, documents, Apple Notes, Telegram sessions, and cryptocurrency wallet information. A secondary module copies the browser profile and launches a hidden Chromium instance controlled through the Chrome DevTools Protocol, allowing attackers to interact with active sessions that have already passed multi-factor authentication. Persistence is achieved via a disguised LaunchDaemon, and the malware attempts to remove installation artifacts afterward.

OpenAI ChatGPT Computer History Feature on macOS Could Expose Detailed User Activity Logs to Infostealers

OpenAI has introduced the Computer History feature in its macOS ChatGPT app, which records application switches, clicks, keystrokes, and accessibility context to generate AI summaries and memories. The feature is disabled by default and requires explicit activation of Memories, with availability limited to Pro, Business, and Enterprise users outside the EEA, Switzerland, and the UK. While raw event files are deleted after 48 hours and not used for model training, the resulting Markdown memory files remain unencrypted on the local Mac. These files can be read by any process running under the same user account, creating a ready-made activity log for infostealers and other malware. OpenAI also warns about prompt injection risks where hidden instructions from websites or apps could influence ChatGPT or Codex behavior. Users retain controls to select participating apps, pause collection, or delete history, but the lack of encryption on stored memories raises significant privacy concerns.

Zoom Patches Zoomsday Vulnerability Enabling Remote Code Execution in Meetings

Zoom has addressed four vulnerabilities that could allow attackers to compromise meeting participants, including flaws leading to remote code execution without any victim interaction. The most severe issue, CVE-2026-53413, rated 8.3 and nicknamed Zoomsday, resides in the annotation feature used for drawing, highlighting, or adding text during screen sharing. This component processes network data using fixed 128-byte buffers without proper size validation, enabling memory corruption that alters program execution flow. Researchers demonstrated the attack on macOS by silently launching Safari on the victim's machine. The flaws affect Zoom Workplace, Zoom Rooms, Meeting SDK, and VDI clients. Users must update to patched versions such as Workplace 7.1.5 or 7.0.6, and Zoom Rooms or Meeting SDK 7.1.5 to mitigate annotation-related risks. No active exploitation has been observed publicly, yet centralized enterprise deployments require priority updates since attacks can occur during live meetings.

Telegram Removed from App Store After Extortionist Plants AI-Modified CSAM in Archived Message

Pavel Durov stated that an extortionist edited an old public group message by inserting AI-altered child sexual abuse material, allowing the post to evade detection by active chat participants while enabling a direct report to Apple. The tactic triggered automatic removal of Telegram and experimental Telegram X from the App Store in multiple countries including Russia, Turkey, and the United States on August 4. Apple restored the applications after Telegram deleted the prohibited content and blocked the responsible account, with the entire outage lasting approximately ninety minutes. During the incident, push notifications failed for some iOS users, while macOS and Android versions remained unaffected. Durov criticized Apple for suspending the app without prior contact and warned that the same mechanism could be used against any user-generated content platform. Telegram urged Apple to apply equal scrutiny to all incoming reports rather than acting on isolated complaints that bypass normal moderation filters.

macOS Users Encounter Phishing and Scams More Often Than Windows Users but Adopt Fewer Protections, Kaspersky Study Reveals

A new study from Kaspersky Lab shows that macOS users report higher rates of phishing encounters and various scams compared to Windows users, yet they are less likely to implement basic security measures. Over the past year, 12 percent of macOS users faced phishing attempts versus 9 percent of Windows users, while 16 percent encountered investment fraud schemes compared to 13 percent. Privacy violations and personal data theft were also reported more frequently by Mac owners at 11 percent and 12 percent respectively, against 8 percent and 7 percent for Windows. Security habits differ notably, with only 51 percent of macOS users avoiding suspicious links and emails versus 62 percent of Windows users, and just 35 percent installing additional protection tools compared to 42 percent. Password practices and multi-factor authentication usage follow the same pattern, with Mac users trailing in creating unique or complex passwords and enabling 2FA. Kaspersky notes that while macOS built-in defenses handle many threats effectively, they offer limited protection against social engineering and platform-specific attacks, underscoring that the Apple brand does not serve as automatic security.

69% of Browsers Worldwide Vulnerable: How Chrome Sync Enables Stealth Surveillance Without Malware

Google Chrome's standard synchronization feature can be silently abused to turn any browser into a surveillance tool, requiring only brief physical access to a victim's device and the addition of an attacker's Google account. Security researchers at Certo highlighted the technique after multiple cases involving intimate partner surveillance, including one incident where a woman’s visits to a family lawyer and domestic abuse support sites were monitored in real time by her partner. Once sync is enabled, browsing history, bookmarks, open tabs, autofill data, and saved passwords are automatically transmitted to the attacker’s profile, which can be viewed from any device worldwide without needing the victim’s password or installing spyware. Chrome provides no prominent warnings about new profiles or active synchronization, and alerts about logins are sent only to the account owner rather than the device owner. With Chrome holding a 69.65% global market share according to StatCounter data from June 2026, the method potentially affects millions of users on Android, iOS, Windows, and macOS. Experts recommend regularly checking connected profiles in browser settings, using Incognito mode for sensitive activity, securing devices with strong passcodes and biometrics, and immediately removing unknown accounts while changing important passwords.