‘Cthulhu Stealer’ macOS Malware Can Steal Keychain Passwords, Web Browsing Info, Crypto Wallets, and More

Apple’s Macs are less targeted by malware than Windows PCs, but that doesn’t mean they are immune. Increasingly, insidious types of Mac malware are being developed that have researchers concerned enough to issue public warnings, and that’s the case again today. As reported by Hacker News, Cado Security has identified a malware-as-a-service (MaaS) targeting macOS users named “Cthulhu Stealer.” First spotted in late 2023, the malicious software is designed to steal sensitive information from infected Macs, such as saved passwords from iCloud Keychain, information from web browsers, and even details from Telegram accounts.

California woman fed up with stolen mail sends Apple AirTag to herself to catch thief

A Southern California woman fed up with her packages getting stolen out of her post office box sent an Apple AirTag to the address and cleverly tracked down the suspected thief, police said. The woman had had several items stolen from her mailbox at the Los Alamos Post Office already when she thought of the idea, the Santa Barbara County Sheriff’s Office said Tuesday. Apple’s $29 AirTags have become popular items since their 2021 release, helping users keep tabs on the location of anything from their lost keys to wallets and luggage.

Dutch Regulator Fines Uber €290 Million for GDPR Violations in Data Transfers to U.S.

The Dutch Data Protection Authority (DPA) has fined Uber a record €290 million ($324 million) for allegedly failing to comply with European Union (E.U.) data protection standards when sending sensitive driver data to the U.S. “The Dutch DPA found that Uber transferred personal data of European taxi drivers to the United States (U.S.) and failed to appropriately safeguard the data with regard to these transfers,” the agency said. The data protection watchdog said the move constitutes a “serious” violation of the General Data Protection Regulation (GDPR). In response, the ride-hailing, courier, and food delivery service has ended the practice.

Fake funeral “live stream” scams target grieving users on Facebook

Some scammers have the morals of an alley cat. But some sink even lower. Over the last few months, Malwarebytes Labs has discovered scammers active on Facebook that prey on bereaved people by using stolen images and phony funeral live stream links to steal money and/or credit card details. These scammers are becoming more active and new cybercriminals are picking up the method as well, which is something we see very often. When some scheme works, more lowlifes join in.

New Android Malware NGate Steals NFC Data to Clone Contactless Payment Cards

Cybersecurity researchers have uncovered new Android malware that can relay victims’ contactless payment data from physical credit and debit cards to an attacker-controlled device with the goal of conducting fraudulent operations. The Slovak cybersecurity company is tracking the novel malware as NGate, stating it observed the crimeware campaign targeting three banks in Czechia. The malware “has the unique ability to relay data from victims’ payment cards, via a malicious app installed on their Android devices, to the attacker’s rooted Android phone,” researchers Lukáš Štefanko and Jakub Osmani said in an analysis.