Jamf Threat Labs discovers and investigates CrashStealer, a C++ macOS infostealer that impersonates Apple's crash-reporting framework to harvest browser credentials, cryptocurrency wallets and keychain data, encrypting stolen files with AES-GCM before exfiltrating them to a remote command-and-control server.
[…]
Unlike the payload it eventually installs, the dropper is properly code signed and notarized: it is a universal (arm64 and x86_64) binary signed with the Developer ID Emil Grigorov (WWB7JA7AQV), has hardened runtime enabled, and carries a stapled notarization ticket. Notably, the disk image itself is signed as well, not just the application inside it, which is uncommon in malicious DMG delivery where the container is typically left unsigned.
[…]
That file supplies the curl command the dropper runs next. Staging the first hop on a trusted developer domain keeps the initial network activity inconspicuous.
[…]
[The script] clears extended attributes on the staged bundle with xattr -cr, makes the inner binary executable, strips the payload's existing signature and re-signs it ad-hoc (codesign --remove-signature followed by codesign -s - --force --deep --no-strict), registers it with Launch Services via lsregister -f, and finally launches it in the background with open -g -n.
My team rewrote Apple’s TrueType hinting interpreter in Swift, ask me anything.
[…]
I feel like naming just one would be a disservices to all of the features that made this effort possible (C interop, generics, noncopyable/nonescapable types) but at the end of the day I think the star of the show was the optimizer; despite being faster than the code it replaced, the new code is super readable and that was only possible because the optimizer was able to completely eliminate all of our abstractions.
The new version is faster, but the main motivation was security concerns.
Is hinting useful/being used in the days of hi-dpi displays? I was under impression that Apple switched to grayscale anti-aliasing and ditched hinting.
For the most part hinting isn’t really necessary anymore, but thanks to being Turing-complete it has been Hyrum’s law-ed by at least one CJK font that uses hinting to lay out strokes in its characters.
One of the axioms for this project was that I wanted my team to write the most boring code possible—nearly identical structurally to the code it was replacing, because to do otherwise would introduce binary compatibility risk. The other axiom was 100% test coverage for all new code as it landed, with the same units testing both interpreters.
Font parsers process data from untrusted sources, making the TrueType hinting interpreter a security-critical attack surface. To make the format more resilient on Apple platforms, we rewrote its hinting interpreter from C to memory-safe Swift for the Fall 2025 releases. In addition to memory safety, we also improved performance: on average, our Swift interpreter runs 13% faster than the C interpreter it replaced.
[…]
Binary compatibility was crucial for this project to succeed: existing programs had to continue to function the same as they did before, effectively unaware that a new implementation was in place. This means not just interface compatibility but pixel-identical glyph rendering as well, relative to the C implementation.
[…]
To ensure correctness, we developed two test suites. The first was a unit test suite that can target both implementations, providing exhaustive (99.7%) code coverage for both. This suite is included with the open source release of the Swift interpreter.
Then, to represent real-world workloads, we used a fuzzer to minimize a corpus of 10 million PDF files down to 4,200 without any loss of code coverage.
[…]
Following WebKit’s Safer Swift Guidelines, the example below demonstrates how to wrap a bridged structure from C in a projection type that uses Ref for lifetime safety, brokers bounds-safe access to the underlying data, and returns idiomatic Swift types to its callers.
Apple has released a new update to XProtect, its built-in malware protection tool, for all macOS versions.
This update bumps XProtect to version 5351 (from 5347) — the first broad release since early June — and adds fresh detection rules for several threats, including the Boatload stealer family and new osascript-based malware.
As usual, Apple provides no public details on the specific threats addressed. All users should check that the update has installed.
This version adds six new Yara rules for MACOS.ANGRYORB.OX, MACOS.BOATLOAD.STCRST, MACOS.BOATLOAD.PRIN, MACOS.BOATLOAD.PEME, MACOS.VSHELL.DITA and MACOS.VSHELL.DR, amends rules for MACOS.MISOMAGIC.PA, and tidies spacing for those for MACOS.SOMA.STTX. From the rules for Boatload, that would appear to be a stealer.
Osascript rules in XPScripts.yr gain no less than 14 new rules, and amend those for MACOS.OSASCRIPT.TIPA, MACOS.OSASCRIPT.SYPR, MACOS.OSASCRIPT.TADE and MACOS.OSASCRIPT.REOB.
You can check whether this update has been installed by opening System Information via About This Mac, and selecting the Installations item under Software.
MacDailyNews Note: More info via the full article here.
Please help support MacDailyNews — and enjoy subscriber-only articles, comments, chat, and more — by subscribing to our Substack: macdailynews.substack.com. Thank you!
Meta, who owns and operates FaceBook and Instagram, has enabled a setting automatically that allows anyone to use your public Instagram photos, profile picture, and/or reels for AI purposes. This includes everything from your posts, stories, stickers, reels, and even your profile photo. Some users may not like this, whether they’re opposed to AI in ... Read More
Maintenance release with a handful of improvements and bug fixes for the password manager. ($47.88 annual subscription, free update, 4.8 MB, macOS 12+)
Apple’s Hide My Email feature has a vulnerability that does exactly what the name says it shouldn’t: reveal your real email address. Worse, Apple has ignored reports of the flaw for over a year.
7-Zip version 26.02 was released to fix a remote code execution vulnerability that could allow attackers to execute malicious code by convincing users to open specially crafted compressed files. [...]
Public exploits have been released for the critical "wp2shell" remote code execution vulnerabilities affecting WordPress Core, making it imperative that administrators patch their sites immediately. [...]
EU tech regulation, Digital Markets Act, Apple Europe sales, Apple regulation, European Union, Siri AI, iPhone features, device interoperability, App Store changes, alternative marketplaces, iPhone Mirroring, AirPods translation, Apple privacy, iPhone security, app sideloading, platform competition, DMA compliance, Apple Intelligence, European technology, government control
EU tech regulation is no longer limited to App Store payment rules or competition disputes hidden from ordinary consumers. It is beginning to determine which features reach European devices, how quickly they arrive and how deeply third-party companies can interact with the iPhone, iPad and Mac.
The Digital Markets Act was designed to reduce the control of large technology platforms over software distribution, payments, browsers, digital assistants and connected hardware. For Apple, compliance has already produced alternative app marketplaces, web distribution, third-party payment options, additional default-app controls and expanded access to iPhone technologies.
The next phase reaches much deeper into the operating system. European regulators want competing accessories, cloud services and AI assistants to receive access to capabilities traditionally reserved for Apple’s own products.
Apple argues that some of those demands could weaken privacy and security. The European Commission says the company is responsible for creating compliant systems that preserve both competition and user protection.
Between those positions sits a large and commercially significant group of customers. Europe generated $28.06 billion in Apple sales during the quarter ending March 28, 2026, up from $24.45 billion one year earlier. Six-month European sales reached $66.20 billion, compared with $58.32 billion during the same period of fiscal 2025.
Europe therefore represented more than one-quarter of Apple’s latest quarterly revenue. It is too valuable to leave behind, but increasingly difficult to serve with the same software experience available elsewhere.
EU Tech Regulation Is Splitting Feature Availability
Regional differences once centered mainly on language support, licensing agreements or local services. EU tech regulation is creating a more structural divide.
Apple has blamed Digital Markets Act requirements for delaying Siri AI across the European Union. The company says regulators expect competing AI assistants to receive extensive access to personal information, apps and device actions before Apple can reserve those capabilities for its own assistant.
The disagreement concerns more than answering questions. Siri AI is designed to read personal context, understand onscreen information and complete actions across apps. That may include finding messages, accessing files, making purchases or sending information on the user’s behalf.
Opening those capabilities to outside AI systems requires new permission structures, technical interfaces and safeguards. Apple says it cannot release its assistant first and add competing access later without risking regulatory action. The Commission says Apple had sufficient time to design an interoperable solution.
Other delayed European features have included iPhone Mirroring on Mac, Live Translation through AirPods and certain location-based Maps capabilities. Each feature touches a different part of the ecosystem, but all depend on privileged communication between Apple devices, software and services.
The consequence is becoming visible at purchase. Two customers can buy the same iPhone model at similar prices and receive different capabilities because one lives inside the European Union.
Image Credit: Apple Inc.
Feature Adoption Becomes Slower and Less Predictable
Delayed availability can weaken the adoption of new hardware features even when the devices themselves continue selling well.
Siri AI is intended to become a central part of newer iPhones, iPads and Macs. Buyers who cannot access it lose part of the justification for newer chips, additional memory and on-device AI processing. Developers also face a smaller addressable audience for apps built around the new assistant.
AirPods Live Translation presents a similar problem. A feature designed to demonstrate the combination of iPhone processing, microphones and wearable audio becomes unavailable in a region built around dozens of languages and frequent cross-border travel.
iPhone Mirroring affects the relationship between iPhone and Mac. Users outside the EU can interact with the phone from macOS, while European users may receive notifications without gaining the complete experience.
These differences do not necessarily stop hardware sales. Apple’s newest results show strong European demand despite years of regulatory conflict. They can, however, reduce the speed at which customers use the ecosystem’s newest capabilities.
The effect may grow as software becomes a larger part of hardware differentiation. A faster processor has limited emotional value when the feature designed to demonstrate it is unavailable.
Apple Sales Show Why Europe Cannot Be Ignored
Apple does not report European Union revenue separately. Its Europe segment also includes countries outside the bloc, along with India, the Middle East and Africa. The official segment remains the best regularly published measure of the region’s commercial weight.
European sales rose approximately 15% year over year in Apple’s latest reported quarter. During the first six months of fiscal 2026, the segment expanded by roughly 14%.
Those figures weaken the argument that regulation is already driving customers away from Apple hardware. Demand remains strong, supported by the iPhone 17 family, Mac sales, services and the company’s installed base.
The financial risk is more gradual. Regional software fragmentation can raise engineering costs, delay launches and make European devices less competitive against products able to offer complete feature sets.
Apple must maintain separate distribution rules, payment systems, browser options and eligibility checks. Developers must decide whether alternative stores, external payments or EU-specific business terms justify additional work. Support teams must explain why features differ between countries using the same operating-system version.
A market responsible for more than $28 billion in one quarter can absorb considerable compliance expense. It can also influence Apple’s global product decisions when regulators demand interfaces that cannot be restricted to Europe easily.
A Slow Transfer of Ecosystem Control
The escalating regulatory environment also creates a more fundamental concern: control over complex technology ecosystems can gradually move away from the companies that designed them and toward government committees, regulatory bodies and administrative processes.
That transfer rarely happens through one dramatic order. It develops through repeated obligations covering app distribution, payment systems, browser engines, digital assistants, hardware access, data portability and interoperability. Each requirement may appear narrow when considered alone. Together, they can redefine who determines how the ecosystem operates.
Apple built its platform around tight integration between hardware, software, services and security. Regulators increasingly treat parts of that integration as market power that must be opened to competitors. The danger is that an ecosystem designed as one coordinated environment becomes subject to decisions made by committees that do not carry direct responsibility for product quality, reliability or long-term maintenance.
This can become a slow trap. Once a platform is required to expose one layer, regulators may use that access as the basis for demanding another. A payment exception can be followed by alternative app stores. Alternative stores can lead to broader installation rights. Device interoperability can expand into access for AI assistants, personal data and system actions.
The boundaries of the platform are then set less by engineering judgment and more by regulatory negotiation.
Government agencies have legitimate authority to address competition and consumer harm. The concern appears when regulation shifts from preventing abusive conduct to directing product architecture. At that point, public authorities begin influencing feature design, release timing, software permissions and the relationship between first-party and third-party services.
That creates consequences beyond Apple. Any company considering a tightly integrated product may decide that deep integration invites intervention. Businesses could avoid building ambitious ecosystems if successful coordination later becomes grounds for forced access.
Innovation then becomes shaped by what regulators are likely to permit rather than by what engineers believe will produce the safest or most coherent experience.
Image Credit: Ink Drop / Alamy Stock Photo
Competition Gains Come With Real Consumer Choices
EU policy has produced benefits that Apple rarely emphasizes. Users can install apps through alternative marketplaces or directly from authorized developers. Developers can offer external payment methods, promote different prices and avoid relying entirely on Apple’s distribution system.
Alternative browser engines can compete with WebKit, while users have more control over default apps. Contactless payment access has expanded beyond Apple Pay, allowing competing wallet providers to use the iPhone’s NFC technology under approved conditions.
Interoperability requirements could also improve third-party accessories. Smartwatches, headphones and other devices may gain better notification access, background connectivity and proximity pairing with the iPhone.
These changes can increase competition and reduce the advantage Apple gives its own services and accessories. A third-party smartwatch should not become artificially less useful simply because it was not made in Cupertino.
The difficulty is separating legitimate platform access from unlimited access. A notification interface is one thing. An autonomous AI assistant capable of reading messages, accessing files and acting across apps introduces a different level of sensitivity.
Privacy and Security Risks Are Not Theoretical
Alternative app distribution increases user choice, but it also moves some responsibility away from the App Store. Apple continues to notarize apps distributed through approved alternative channels, checking for known malware and severe fraud. That process is narrower than a complete App Store review.
Purchases made outside Apple’s payment system also fall outside its normal refund and billing support. Users may need to resolve disputes directly with the developer or payment provider.
A malicious marketplace, deceptive payment page or compromised developer account can create opportunities for fraud. Enterprise users face additional concerns when employees install software from sources their organization has not approved.
The AI question reaches further. A third-party assistant may need permission to access messages, photos, calendars, documents and app controls. Even a reputable provider can collect more information than the user expects or introduce vulnerabilities through poorly designed integrations.
Apple can build permission prompts, app isolation and revocation controls, but technical access always creates some exposure. Security depends on how narrowly permissions are defined, how visibly they are used and whether the operating system can stop unauthorized actions.
The Commission maintains that interoperability and privacy can coexist. Apple maintains that regulators are demanding access before adequate protections are ready. Both positions contain a legitimate concern: dominant platforms should not block competition, and competition should not require users to surrender control of personal data.
When regulators require a company to alter its architecture, responsibility can become blurred.
Apple remains the company customers blame when an iPhone feature fails, a third-party marketplace distributes a harmful app or an outside assistant misuses personal data. Regulators may have required the access, but they do not operate the device, provide technical support or repair the damage to the platform’s reputation.
This creates an accountability gap. Government committees can mandate openness without assuming the commercial and security consequences of that openness. Apple must comply, maintain the system and explain the outcome to users.
The same problem applies to delayed features. Regulators may argue that Apple chose not to release a service, while Apple may argue that the required conditions made the launch unsafe or technically impractical. Customers are left with less functionality and no simple way to determine who caused the delay.
Over time, the ecosystem can become a negotiated compromise rather than a product with one coherent direction. That may satisfy formal compliance while producing a weaker experience for everyone involved.
The risk is not that governments will literally operate Apple’s software. It is that committees increasingly define the conditions under which Apple can design, connect and release its own features. Control shifts through constraints.
The Industry Will Follow Europe’s Experiment
The consequences extend beyond one company. Google, Meta, Microsoft, Amazon and other platform operators face related European obligations. Hardware makers must consider whether ecosystem advantages can survive when core services are required to support rivals.
Smaller developers may gain new distribution and payment choices, but they may also inherit more compliance, customer-service and security responsibilities. Accessory companies could compete more effectively while becoming accountable for handling sensitive device data.
Other governments are watching. Rules introduced in Europe can influence legislation elsewhere, particularly when companies decide that maintaining one global technical framework is easier than operating several regional versions.
Apple is unlikely to abandon Europe or stop adapting its products. Its sales provide too much evidence of the region’s importance. The company will continue negotiating, appealing decisions and building compliance systems while withholding features it considers unsafe under current demands.
European customers may receive more app stores, payment choices and accessory compatibility. They may also wait longer for headline features included with the same hardware elsewhere.
The deeper consequence may be a technology industry that becomes more cautious about building tightly integrated products. Companies may design around anticipated regulatory demands from the beginning, limiting exclusive features, reducing private-system integration or avoiding innovations that depend on controlled access.
EU tech regulation began as an effort to constrain dominant platforms. Its long-term effect may be to transfer part of the power to shape those platforms from companies and users to regulatory institutions.
That shift deserves scrutiny equal to the market power it is intended to correct. Competition rules can restrain abuse. They can also become a slow mechanism for placing product design, security choices and ecosystem evolution under government supervision.
Shady Control and Bureaucracy
The danger grows when regulatory discretion becomes buried beneath permits, approvals, negotiations and technical committees that operate beyond meaningful public scrutiny.
The more power officials hold over which features, contracts or technologies may proceed—and when—the greater the opportunity for lobbying, favoritism and selective enforcement to influence outcomes. What begins as oversight can gradually become a system in which delay itself is leverage, while responsibility disappears inside layers of administration.
For the technology industry, that risks replacing transparent product decisions with political access, negotiated exceptions and regulatory influence exercised far from the consumers expected to live with the consequences.
Microsoft has observed a surge in attacks using the ACR Stealer malware to steal browser-stored passwords, authentication tokens, and sensitive documents from its enterprise customers. [...]
As age verification laws expand worldwide, organizations face growing pressure to protect users' privacy while meeting regulatory requirements. Incode explains how on-device age estimation verifies age without transmitting or storing facial images, reducing biometric privacy risks while supporting compliance. [...]
Plus: Russian cyberspies turn to infrastructure hacking, DHS repeatedly fails to realize it’d been hacked, a breach exposes an AI music generator’s scraping ways, and more.
Plus: Russian cyberspies turn to infrastructure hacking, DHS repeatedly fails to realize it’d been hacked, a breach exposes an AI music generator’s scraping ways, and more.
NHS warns curiosity over patient records could end healthcare careers permanently
Jail time now joins dismissal for unlawful access to confidential medical records
High-profile crime victims' records triggered tougher NHS privacy enforcement nationwide
NHS England has launched a nationwide campaign warning staff that accessing patient records without proper legal justification could end their careers.
The initiative includes screensavers and posters across NHS organisations reminding workers not to let curiosity override professional and legal boundaries.
Staff who breach these confidentiality rules risk disciplinary action, dismissal, regulatory referral, or even imprisonment under existing data protection legislation.
A response to recent high-profile breaches
The campaign follows several recent dismissals linked to staff who unlawfully viewed records connected to victims of high-profile crimes nationwide.
NHS England specifically cited unlawful access incidents involving the 2023 Nottingham attacks and the 2024 Southport knife attack, both of which drew significant national attention.
“Patients must be able to trust that their personal information is kept confidential by the NHS – any instance of staff looking at records without a valid reason is wholly unacceptable, a disgraceful breach of patients’ trust and against the law,” said Sir Jim Mackey, NHS Chief Executive.
He added that most staff manage patient information appropriately, although a limited group has seriously damaged that confidence through inappropriate access.
New guidance has now been issued outlining different categories of unlawful access, alongside advice on monitoring and conducting regular audits.
Some newer electronic patient record systems can reportedly flag suspicious activity in real time, helping organisations identify unauthorised access quickly.
Breaches can be reported to both the Information Commissioner's Office (ICO) and police, who may pursue criminal prosecution under the Data Protection Act 2018.
Legal consequences and independent findings
The ICO reiterated the expectations of patients and staff, as well as the consequences of this illegal action.
“When people seek medical care, they share some of their most sensitive personal information in the trust that it will be kept safe,” said Paul Arnold, Chief Executive of the ICO.
“Unauthorised access to those records is not just a breach of data protection law — it is a betrayal of that trust, with real and lasting consequences for patients and their families…Staff who breach that trust face serious consequences: loss of employment, removal of professional accreditation and criminal prosecution.”
The temptation to access patient records unlawfully often increases when cases attract widespread public attention.
"When a local incident becomes national news – a serious crime, a public tragedy, a story that captures widespread attention – there is an increased risk that healthcare staff could be tempted to look at records they have no reason to view," Arnold added.
“Anyone considering accessing records for personal reasons or out of curiosity should be in no doubt they could be putting their career at risk, and may face disciplinary action, dismissal, referral to the regulator or even time in prison,” said Sir Jim Mackey.
Findings show that 18 staff members at York and Scarborough Teaching Hospitals wrongfully accessed patient records since 2021.
Eight of those 18 cases were subsequently referred onward to the ICO for further formal investigation.
Another investigation began after up to 40 staff members reportedly accessed the medical records of a three-year-old boy injured in a crocodile enclosure incident near Huntingdon.
Cambridge University Hospitals said restrictions had already been placed on the child's records and confirmed any staff lacking legitimate clinical or operational reasons would face disciplinary action, including dismissal.
Offences under the Data Protection Act 2018 and Computer Misuse Act 1990 can carry fines and prison sentences for those convicted.
The scale of these repeated incidents suggests that existing safeguards have not consistently deterred staff from unlawfully viewing sensitive records.
“Having the ability to view a record is not the same as having a legitimate need to do so. Every member of staff has a personal responsibility to respect that boundary…” Arnold added.
Now, the CEO of JPMorgan has described the risks the technology poses as a “real issue,” and likened wide access to the AI as “giving ballistic missiles to individuals.”
Speaking at the Pennsylvania Defense and Innovation Summit, JPMorgan’s Jamie Dimon underscored the risks posed by the AI, which has already been shown to both identify and exploit cybersecurity challenges.
Mythos isn’t Skynet
Currently, Claude Mythos is limited to a small selection of organizations, companies, and federal and military departments. Public access to the AI has been blocked, and worldwide access has been blocked due to the potential security issues of this powerful AI.
Claude Mythos is not the type of threat that can become self-aware and take over military appliances like the fictional Skynet of the Terminator movie series. However, it does have the capacity to cause immense damage in the wrong hands.
The AI is capable of detecting cybersecurity vulnerabilities and reporting on them; it is also able to generate automatic exploits. So, for white hat cybersecurity analysts, it is a powerful defensive tool, but in the wrong hands, it is a destructive power. In addition, its automated capabilities make it easy for black hats to scale their cybercrime operation and make ransomware, phishing, and other data-based scams more profitable.
It isn’t just cybersecurity where Anthropic’s Claude Mythos AI has demonstrated such incredible capacities. Scientific research, specifically biology, can be targeted by attackers using AI to turn complex concepts into terms, potentially to misuse the information.
There is also the challenge of a strategic imbalance between single nations or bodies having exclusive access to the technology.
Will the public ever access Anthropic’s Claude Mythos?
Given the security considerations, it seems unlikely that Claude Mythos will be publicy available anytime soon. However, Anthropic has already stated that it intends Mythos-level features and capabilities to become more widely available.
For this to happen, however, it needs to develop and apply various safeguards.
The most likely scenario is that public access to Mythos is eventually unblocked, with restrictions to specific features that relate to cybersecurity and biological/medical tasks and research.
Project Glasswing is already in operation with a handful of key partners (including Amazon Web Services, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, and others), and will probably be expanded until the safeguards are demonstrated to be fit for purpose, and public use.
Login
