ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “BlockBlock”

7 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 3Phishing & fraud 2Vulnerability 1Ransomware 1
SeverityAllcritical 1high 4medium 2low 0info 0

Apple Updates Everything, (Mon, Sep 14th)

Apple patched a record 261 vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS 27, and other platforms, with none flagged as exploited.

Apple's annual OS update shipped iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27, and visionOS 27 plus bug-fix releases for the 26 and 15 branches, fixing a record 261 vulnerabilities. Notable issues include multiple kernel flaws allowing root privilege escalation (CVE-2026-43689, CVE-2026-43691, CVE-2026-43698, CVE-2026-43786), remote code execution in CUPS (CVE-2026-43692), kernel memory corruption via malicious NFS servers (CVE-2026-43686, CVE-2026-43687), and WebKit memory corruption from crafted web content (CVE-2026-43715). No vulnerabilities are labeled as actively exploited, and Apple does not assign per-CVE severities. Users report iOS 26.7 being downloaded when iOS 27 is intended, and tools like Little Snitch and BlockBlock need updates before upgrading to macOS 27.

SANS Internet Storm Center · 1d agoVulnerabilityCVE-2022-3437CVE-2026-20683CVE-2026-28899+27 CVEs

ClickFix attacks are tricking Mac and Windows users into hacking themselves

ClickFix campaigns trick users into pasting terminal commands via fake CAPTCHAs; latest wave abused HBO Max's hacked Reddit account to push infostealer ads.

ClickFix attacks use fake CAPTCHA or anti-bot prompts on hacked or counterfeit websites to convince victims to copy a command into Windows Command Prompt or macOS Terminal, instantly installing infostealers that steal passwords, logged-in sessions, and crypto wallets. The latest campaign compromised HBO Max's official Reddit account to post hundreds of fake ads linking to a spoofed HBO Max page carrying the lure, per researchers at Hudson Rock. It is unclear how many users were compromised. Because execution happens in the terminal, many attacks evade antivirus tools; enterprises can block terminals domain-wide and Mac users can deploy BlockBlock.

TechCrunch · Security · 1d agoPhishing & fraud in the wild1

ClickFix attacks infecting PCs and Macs are going viral

ClickFix social engineering attacks are spreading widely, delivering malware to Windows and macOS users by tricking them into running malicious terminal commands that bypass Gatekeeper.

BlueVoyant reports the Lorem Ipsum malware operation pivoted to ClickFix in late May 2026, dropping code-signing infrastructure and broadening its victim pool from Microsoft Teams searchers to anyone browsing a compromised website. Jamf and independent researchers documented macOS ClickFix variants that bypass Gatekeeper protections. Cisco Talos observed attackers abusing published Google Sheets for control traffic, while Netskope counted 5,400 sites beaconing to one campaign; Sandworm has separately hosted control infrastructure in blockchain smart contracts.

Ars Technica · Security · 5d agoPhishing & fraud in the wild1