Security

It’s a little-known fact that before emails reach your inbox, they pass through a buffer designed to scan and block malicious content. However, over time, email providers—especially Gmail—have shifted their focus to just adding “warning labels” to those with suspicious links or attachments. This approach, best described as “beating around the bush” hasn’t reduced threats much at all. Shockingly, 91% of all cyberattacks still originate from emails. So, what gives?

9to5Mac Security Bite is exclusively brought to you by Mosyle, the only Apple Unified Platform. Making Apple devices work-ready and enterprise-safe is all we do. Our unique integrated approach to management and security combines state-of-the-art Apple-specific security solutions for fully automated Hardening & Compliance, Next Generation EDR, AI-powered Zero Trust, and exclusive Privilege Management with the most powerful and modern Apple MDM on the market. The result is a totally automated Apple Unified Platform currently trusted by over 45,000 organizations to make millions of Apple devices work-ready with no effort and at an affordable cost. Request your EXTENDED TRIAL today and understand why Mosyle is everything you need to work with Apple.

A recent report by 404 Media revealed that law enforcement agents have been concerned about iPhones automatically rebooting themselves, which makes it very difficult to hack these devices. Security researcher Jiska Classen later discovered that this behavior is caused by a new feature called “Inactivity Reboot,” which has now been reverse-engineered by Classen.

Some six years after virtual private network company NordVPN started searching data breaches for the most-used passwords, things are every bit as bad as when the company started.

Each year, the company searches the dark web for passwords stolen by malware or exposed in security breaches to determine the most commonly-used passwords, and this year’s crop is as depressing as ever …

Apple released a ton of software updates today, including iOS 18.1, macOS Sequoia 15.1, and more. But there was another key software release you may be unaware of. If you’re not yet running iOS 18, Apple’s new iOS 17.7.1 update includes important security fixes for your iPhone.

Today Apple released big new software updates for all its platforms, including iOS 18.1, macOS Sequoia 15.1, and more. Now, the company has released full details on all of the security updates added in those releases. Here’s what you should know.

A UnitedHealth hack exposed the personal information and health data of more than 100M Americans – the first time the company has put a specific number on the security breach.

A ransomware attack was made on Change Healthcare back in February, but it was only yesterday that the company revealed its “unprecedented magnitude” …

9to5Mac Security Bite is exclusively brought to you by Mosyle, the only Apple Unified Platform. Making Apple devices work-ready and enterprise-safe is all we do. Our unique integrated approach to management and security combines state-of-the-art Apple-specific security solutions for fully automated Hardening & Compliance, Next Generation EDR, AI-powered Zero Trust, and exclusive Privilege Management with the most powerful and modern Apple MDM on the market. The result is a totally automated Apple Unified Platform currently trusted by over 45,000 organizations to make millions of Apple devices work-ready with no effort and at an affordable cost. Request your EXTENDED TRIAL today and understand why Mosyle is everything you need to work with Apple.

For years, Apple provided its built-in Keychain password management tool hidden within the Settings app. This tool allowed passwords to be automatically generated and saved in the Passwords section, but it could often be cumbersome when a user wants to manage particular logins.

Now, in iOS 18, iPadOS 18, and macOS Sequoia, saved passwords have broken away into their own rounded corner island on the home screen called Passwords. Apple hopes this new app will make managing credentials more convenient for users. However, there are concerns that it may not offer enough features to replace paid password managers. Sure, but is that the goal?

Whenever an Apple device generates a strong password for you, the structure of those secure passwords isn’t entirely random.

Instead, Apple created rules specifically designed to make them easier to type if you ever have to do that manually, and to make them briefly memorable …

9to5Mac Security Bite is exclusively brought to you by Mosyle, the only Apple Unified Platform. Making Apple devices work-ready and enterprise-safe is all we do. Our unique integrated approach to management and security combines state-of-the-art Apple-specific security solutions for fully automated Hardening & Compliance, Next Generation EDR, AI-powered Zero Trust, and exclusive Privilege Management with the most powerful and modern Apple MDM on the market. The result is a totally automated Apple Unified Platform currently trusted by over 45,000 organizations to make millions of Apple devices work-ready with no effort and at an affordable cost. Request your EXTENDED TRIAL today and understand why Mosyle is everything you need to work with Apple.

In possibly a first since the release of macOS Sequoia, cybersecurity researchers have identified a new attack vector that sidesteps the usual “right-click, open” in favor of something rather unusual. In a recent finding shared on social media, this new method involves tricking users into dragging and dropping malicious code (via a .txt file) directly into the Terminal.

It was revealed this weekend that Chinese hackers managed to access systems run by three of the largest internet service providers (ISPs) in the US.

What’s notable about the attack is that it compromised security backdoors deliberately created to allow for wiretaps by US law enforcement …

A MoneyGram hack has seen an attacker obtain the personal data of an unknown number of the company’s 50 million money transfer users.

A separate hack of a debt collection company has seen personal data obtained for more than 200,000 Comcast customers, despite previous assurances that this was not the case …

A succession of T-Mobile data breaches saw millions of customers have their personal data exposed. The company has now been fined $15.75M, and has agreed to spend the same amount again on upgrading its security.

The Federal Communications Commission (FCC) says that the combination of fine and promised security enhancements represents a model for future handling of such incidents …

Back in late August, The Browser Company – the company behind the popular Mac browser Arc, became aware of a serious security vulnerability in the browser, one that could allow for remote code execution on other users computer with no direct interaction. They patched it promptly once being alerted to it, and the details of the vulnerability were disclosed last week.

macOS Sequoia screen recording permission reminders can now be permanently vanquished, thanks to a new pay-what-you-like app.

Apple’s new security feature was intended to make Macs safer, by reminding us that we’d granted a powerful and potentially dangerous permission to an app, but many experienced users simply found it irritating …

9to5Mac Security Bite is exclusively brought to you by Mosyle, the only Apple Unified Platform. Making Apple devices work-ready and enterprise-safe is all we do. Our unique integrated approach to management and security combines state-of-the-art Apple-specific security solutions for fully automated Hardening & Compliance, Next Generation EDR, AI-powered Zero Trust, and exclusive Privilege Management with the most powerful and modern Apple MDM on the market. The result is a totally automated Apple Unified Platform currently trusted by over 45,000 organizations to make millions of Apple devices work-ready with no effort and at an affordable cost. Request your EXTENDED TRIAL today and understand why Mosyle is everything you need to work with Apple.

On Monday, Apple released its latest iteration of Mac’s operating system, macOS Sequoia. The new update introduced tighter control over app permissions and an overhaul to Gatekeeper, among other features. However, according to TechCrunch, it now appears to be disrupting security tools made by CrowdStrike, SentinelOne, and Microsoft. Social media users are also reporting connection failures with third-party VPNs.

Update (10/2): Thursday’s release of macOS 15.0.1 fixes the underlying networking issues that plagued certain security software in the initial release of macOS 15.

Discord end-to-end encryption (E2EE) is rolling out today for both audio and video calls. You can update to the latest mobile and desktop apps to get access to the privacy protection today.

There are, however, some exceptions to strong encryption, which result from a mix of technical limitations and Discord policy …

Security researchers came up with a pretty wild Vision Pro exploit. Dubbed GAZEploit, it’s a method of working out the passwords of Vision Pro users by watching the eye movements of their avatars during video calls.

They’ve put together a YouTube video (below) to demonstrate how tracking the avatar’s eye movements accurately detects the virtual keys the Vision Pro user is looking at when typing …

9to5Mac Security Bite is exclusively brought to you by Mosyle, the only Apple Unified Platform. Making Apple devices work-ready and enterprise-safe is all we do. Our unique integrated approach to management and security combines state-of-the-art Apple-specific security solutions for fully automated Hardening & Compliance, Next Generation EDR, AI-powered Zero Trust, and exclusive Privilege Management with the most powerful and modern Apple MDM on the market. The result is a totally automated Apple Unified Platform currently trusted by over 45,000 organizations to make millions of Apple devices work-ready with no effort and at an affordable cost. Request your EXTENDED TRIAL today and understand why Mosyle is everything you need to work with Apple.

In a recent web update, Apple made changes to its security releases page to better organize prior years’ security updates and Rapid Security Responses. The company also cleverly included a subtle nod to its Security Bounty Program.

If you’re an IT admin, you’ve got a lot on your plate. Managing the entire user lifecycle can feel like a complex laundry list of manual tasks: switching between systems, provisioning access, configuring and retrieving laptops, resetting passwords, and enforcing security policies. 

A security researcher has discovered a phishing attack intended to fool iPhone users into installing what is claimed to be an update to their banking app.

The attack works despite iOS protections because what is actually being ‘installed’ is a progressive web app, which involves no App Store vetting or warnings …

9to5Mac Security Bite is exclusively brought to you by Mosyle, the only Apple Unified Platform. Making Apple devices work-ready and enterprise-safe is all we do. Our unique integrated approach to management and security combines state-of-the-art Apple-specific security solutions for fully automated Hardening & Compliance, Next Generation EDR, AI-powered Zero Trust, and exclusive Privilege Management with the most powerful and modern Apple MDM on the market. The result is a totally automated Apple Unified Platform currently trusted by over 45,000 organizations to make millions of Apple devices work-ready with no effort and at an affordable cost. Request your EXTENDED TRIAL today and understand why Mosyle is everything you need to work with Apple.

You’ve heard it time and time again–cybercrime is on an unpredicted rise. This encompasses everything from malware to online scams to intellectual property theft. And if you’re anything like me, it’s increasingly hard to grasp the exponentially climbing figures (hence the title of this week’s column). If the day ends in y, there’s some sort of data leak or hack in the news.

And it is Sunday, after all…

In today’s Security Bite, I want to again shed light on a recent Statista Market Insights survey that predicts the annual cost of cybercrime globally will reach $10.29 trillion by 2025. For perspective, that’s more than one-third of the United States’ GDP, which sits at $25.44 trillion as of writing.