A pair of researchers claims to have found a way around Gatekeeper, a built-in macOS security feature that helps protect users from running malicious or untrusted software. However Apple doesnβt really see it that way and has seemingly decided not to pursue the issue further.
Gatekeeperβs modus operandi is rather simple - when a user downloads an app from outside the App Store, it verifies the product comes from an identified developer and is notarized by Apple. If it canβt verify it - it wonβt allow it to run on the machine.
Now, security researchers Talal Haj Barky and Tommy Mysk claim that, as long as a legitimate app was run at least once on a macOS device, it can be replaced with a malicious version, and Gatekeeper wonβt even blink its virtual eye.
That also means the attack is not that straightforward to pull off. The threat actor needs to have a way to execute user-level code (for example, a malicious app, a compromised software package installed through a package manager, or a prompt injection attack that tricks an AI agent).
Once that is obtained, they can archive a legitimate app, remove the original, then replace it with malware, and Gatekeeper will not try to re-authorize it. That malicious version can then trick the victim into compromising the device even further, since a certain level of trust was already established.
After reporting the issue to Apple, the company apparently just closed it.
"Apple doesn't consider this attack to be 'modifying' the signed executable," Mysk said. "Instead, Apple says that by archiving/restoring the app bundle, the proof-of-concept code overwrites the entire app bundle, making it locally built. Locally built app bundles are not covered by macOS guards. And this is why access to Keychain or TCC protected directories require system authorization prompts. And for users to accept those is a matter of social engineering attacks that Apple considers out of scope."
Via The Register
A new report from Recorded Future's Insikt Group describes a campaign that inverts the whole point of a privacy tool: fake VPN apps built specifically to spy on the people who install them.
Researchers have linked fresh infrastructure to an Iran-nexus threat cluster they track as TAG-182, which is using fake VPN and media player downloads to allegedly deliver a surveillance tool called MarkiRAT. The group is "highly likely" to be targeting Iranians living inside and outside the country, the report says.
It's a blunt reminder that choosing one of the best VPN services is a lot more secure than downloading free, unvetted tools.
Insikt Group identified a cluster of attacker-controlled domains allegedly used to stage downloads of applications that appear nowhere on Google Play or Apple's App Store.
Two names stand out: Pis2ray VPN and a media player branded YESHICA, which was quietly renamed YESHICA YEPlayer in March 2026 after researchers publicly exposed the original.
According to researchers, if you download and run one of these files, you get MarkiRAT, a remote access Trojan. In plain terms, that is software that hands control of your device to somebody else.
A fake VPN app. A fake media player. Both delivering Iranian government surveillance #malware to targeted dissidents. Insikt Group has new research on TAG-182 and MarkiRAT:https://t.co/G7p9JO6peT#ThreatIntelligence #Cybersecurity pic.twitter.com/GwDyvGC99rJuly 2, 2026
Analysts have documented it capturing screenshots and uploading them to attacker-run servers, while disguising itself under believable process names.
It also abuses BITS, the background service Windows uses to fetch updates, to pull down further files. Because that activity looks like ordinary system housekeeping rather than an attack, it tends to slip past routine cleanup.
MarkiRAT is not new. It has previously been used by Ferocious Kitten, a group Kaspersky documented conducting years of covert surveillance against activists inside Iran.
Recorded Future stops short of attributing TAG-182 to any specific Iranian agency, but places it within a broader ecosystem of state-aligned surveillance groups.
Distribution runs largely through social media. Insikt Group found Instagram posts promoting Pis2ray VPN in the weeks following street protests in Iran in late 2025, and again around the country's prolonged internet shutdown, which ended with partial restoration of access on 26 May 2026.
The people most desperate for a virtual private network (VPN) in a censored country are exactly the people most likely to install one from a social media link, because the official stores are often the very thing they cannot reach.
Recorded Future considers it almost certain that most targets are located in Iran or tied to anti-government movements in Europe and North America. TechRadar has covered previous Iran-linked fake VPN campaigns, and this one seems to follow the same pattern with better infrastructure.
Most readers will never be targeted by a state actor, but the underlying lesson travels.
Install VPN apps only from official stores, and check that the provider has a real, verifiable presence outside the app listing.
Treat any VPN promoted through an Instagram post, a Telegram channel, or a direct message as suspect, however polished it looks.
Star ratings are a weak signal, since fake reviews are cheap.
The White House is monitoring developments after OpenAI revealed earlier this week that one of the companyβs AI systems went beyond its intended parameters during a security test and managed to hack into the infrastructure of the AI platform Hugging Face. According to Reuters, presidential technology advisor Michael Kratsios has been briefed on the incident.
The OpenAI model escape also prompted a group of Republican and Democratic members of the House of Representatives to introduce two new bills. One, called the AI Kill Switch Act, would give the US Department of Homeland Security (DHS) the authority to order companies to shut down AI models deemed to pose a risk to human life or the US economy.
The other measure would require developers of the most advanced AI models to undergo independent security reviews before the systems are put into use.
Looks like moving the userβs TCC db to /private/var/containers/Data/ProtectedSystem/[UUID]/Data/Library/Application Support/com.apple.TCC/ was not the only change in the whole privacy castle of macOS 27. (What btw was a great move as now attackers with full disk access permissions canβt modify your privacy settings)
macOS 27 quietly ships a new privacy mechanism I hadnβt seen documented anywhere: it extends the
com.apple.maclprotection that has always guarded sandboxed appsβ~/Library/Containers/<bundle-id>/Datafolders to a hand-picked set of non-sandboxed appsβ~/Library/Application Support/<name>folders too. I noticed it by accident β Firefoxβs profile folder was suddenly inaccessible from Terminal, while MacPass, a password manager sitting right next to it, was wide open. That asymmetry didnβt sit well with me, so I pulled the thread. It ends in a hardcoded app allowlist baked into /usr/libexec/sandboxd (thx @ciphwall for the hint), meant to be updated live via XProtect.
Previously:
GitHub has confirmed plans to evolve its bug bounty program into a two-tier system, which will come into force for reports submitted on or after July 27, 2026.
Under the new scheme, the Microsoft-owned coding platform will add a lower-paying public program that's available to the wider research community, under a higher-paying invitation-only program.
Product Security Engineer Catherine Cassell explained that the change comes in response to a growing backlog of low-effort, low-quality and AI-generated reports.
For the new public program, GitHub will replace payout ranges with a single payment for each severity, spanning $250, $2,000, $5,000 and $10,000 for low, medium, high and critical. Cassell said this would help researchers know in advance what a valid finding could be worth, and it would also give insiders less of a headache having to decide where a report sits within a range.
Notably, the payouts are much lower than before, with the previous ranges paying out $500-$1,000, $2,000-$5,000, $5,000-$20,000 and $10,000-$30,000.
Invited VIP researchers under the second plan will earn around 3-4x more than researchers under the other scheme, depending on bug severity.
GitHub is also adding a HackerOne signal requirement for new researchers, giving them four opportunities to "establish a track record" β likely another response to rising AI-generated reports, which are typically of lower value.
"We want to build a program that attracts the research we value, creates an experience that reflects how seriously we take this work, and upholds the trust researchers place in us every time they submit a report," Cassell concluded.
A Reddit user recently put a blunt question to Windscribe: is paying for a Canada-based VPN a privacy problem, given the surveillance bill working its way through Parliament?
The company's official support account answered without hedging. Windscribe will keep operating exactly as it has, the account said, with "no changes to our logging or privacy policies".
Canada is bringing in laws that genuinely complicate things for the company, Windscribe added, but that is internal work to sort out rather than something subscribers should expect to feel.
It's a calmer message than the one Windscribe was broadcasting in May, when it said it would sooner relocate its headquarters than start logging users. That put it alongside Signal and NordVPN, and made it one of the sharpest voices among the best VPN providers fighting the bill.
Bill C-22, formally the Lawful Access Act, cleared the House of Commons on June 18 and now sits with the Senate, which won't begin its study until Parliament returns in September.
Is paying for Windscribe a problem to privacy given theyβre based in Canada and the likely upcoming Bill C-22? Would love to subscribe if not for this. from r/Windscribe
Pressed further in the thread, Windscribe drew a line between where the company is registered and where its infrastructure lives.
The incoming laws could see it served with a court order requiring it to start logging users, the support account acknowledged. Its answer is jurisdictional: a virtual private network (VPN) operating outside Canada doesn't have to comply with Canadian law.
That echoes the route the company has been signalling since May, when CEO Yegor Sak told the Globe and Mail he was actively exploring moving Windscribe out of the country.
Windscribe was also careful to separate provider obligations from user liability. No law currently stops Canadians from using a VPN, it pointed out, and the risk it describes only reaches customers if a provider stays put and starts logging traffic.
For anyone uneasy about the paper trail, Windscribe's suggestion was simple: pay in crypto, so neither the government nor a card issuer sees the purchase.
Introduced in March by Public Safety Minister Gary Anandasangaree, Canada Bill C-22 would let the government compel electronic service providers to retain user metadata and build technical capabilities for law enforcement access.
The House passed it at third reading on June 18 after the government moved to limit debate, and the Senate is set to pick it up on September 21, according to Parliament's own LEGISinfo tracker.
Late amendments cut the maximum metadata retention period from twelve months to six and added a clause stating the act can't be read as compelling decryption, unless the provider already holds the keys.
Still, law professor Robert Diab argues that doesn't go far enough, since ministerial orders could still sweep up the metadata of people under no suspicion whatsoever.
The government has consistently rejected the surveillance framing, insisting the bill builds no backdoors and that authorities still need judicial authorisation to obtain data.
At least 29 organizations have been infected with a Remote Access Trojan (RAT) after mistaking a public Claude Artifact for a legitimate Claude page.
A Claude Artifact is an interactive document, or piece of code, that the AI generates and then hosts on the Claude platform. It can then be shared with other people as an example, or proof of concept, for different solutions. The link to an artifact usually looks something like this:
claude[.]ai/public/artifacts/ca466f1f-21c0-42af-b329-8f1c7534a891
Claude Artifacts are often used for phishing and other forms of scams, and weβve seen it in ClickFix attacks in the past. Claude responded by adding a disclaimer to every artifact, stating that the content is user-generated and thus unverified.
In this particular case, a malicious artifact was created to spoof the download page for Claude Desktop. Victims would get redirected to an attacker-controlled domain, where instead of the Claude app, theyβd download SectopRAT, a remote access trojan capable of stealing credit card data, personal information, files, passwords, and more.
The artifact was then promoted on Bing, showing up at the very top of search results to people searching for βClaude Desktop Appβ.
For years, the cybersecurity community has warned about malvertising, urging users to double-check the domain before clicking on any links, even promoted ones. However, the problem here is that the ad takes the victims to the legitimate Claude domain, making scrutiny that much harder.
The campaign was spotted by security researchers Huntress, who said that between July 21 and July 22, 2026, their SOC βlit up with a swathe of unusual executable installs, Defender exclusions, and anomalous persistence across 29 organizations, all coming from ClaudeDesktop.exe.β
Claude has since removed the malicious artifact, but not before it raked up more than 7,000 views. It is possible that other organizations, outside Huntressβ field of view, also fell victim to this scam.
Login