A security researcher has criticized Apple's macOS bug bounty program for significantly lowering payouts for certain vulnerabilities. Despite increasing rewards for high-profile exploits, many macOS categories now offer much smaller financial incentives, which could discourage researchers from reporting flaws.

MacPersistenceChecker is a macOS app that identifies all items set to run automatically on your system. It helps detect malware and unwanted software by scoring each persistence mechanism based on risk factors. Users can analyze and decide what to keep or remove.

This article breaks down the security architecture of macOS on Apple Silicon, focusing on the immutable Boot ROM and its role in establishing a Chain of Trust. It details how the Boot ROM initializes the system, loads the Low-Level Bootloader, and enforces code integrity through hardware mechanisms like the Public Key Accelerator.

This article reviews new macOS malware discovered in 2025, detailing infection methods, persistence techniques, and the functionality of each specimen. The focus is primarily on information stealers, highlighting their rise in prevalence and the tactics used to distribute them. It also provides links to malware samples for analysis.

The article discusses the evolving concepts of information security, emphasizing the need for depth rather than a simple perimeter defense. It outlines practical threat modeling, the myth of perfect security, and the importance of layered defenses to protect assets like intellectual property and personal data.

The article discusses the vulnerabilities associated with TCC (Transparency, Consent, and Control) on macOS, which regulates app access to sensitive user data. It highlights the misconceptions among developers regarding TCC's importance in protecting user privacy and outlines various scenarios where malware could exploit TCC bypasses.

Santa is a macOS binary and file access authorization system designed to monitor execution and file access, allowing users to manage binary permissions through a local database and various configuration options. It operates in MONITOR or LOCKDOWN modes, supports code signing and path-based rules, and can synchronize settings with remote servers. Santa aims to enhance security by preventing malware execution while integrating into existing defense strategies.

macOS, while generally secure due to built-in protections like Keychain, SIP, TCC, and Gatekeeper, remains a target for cybercriminals who exploit vulnerabilities. The article details these security mechanisms, common attack methods, and emphasizes the importance of monitoring and managing access to sensitive data to thwart potential threats.

A security breach has exposed user data from VirtualMacOSX.com, potentially affecting numerous users who utilized the service. The compromised data includes sensitive information, raising concerns about user privacy and security measures in place. Users are advised to monitor their accounts and take necessary precautions.

A vulnerability in macOS, identified as CVE-2025-31250, allows applications to spoof permission prompts, misleading users about which application is requesting consent. Although patched in macOS Sequoia 15.5, earlier versions such as Ventura and Sonoma remain vulnerable. The author details the discovery process and technical aspects of the vulnerability, emphasizing the implications for user security.

Dillon Franke explores using Mach IPC messages as an attack vector for finding and exploiting sandbox escapes in MacOS system daemons. He details his hybrid approach of knowledge-driven fuzzing, which combines automated fuzzing with manual reverse engineering, and shares insights on identifying vulnerabilities, specifically a type confusion issue in the coreaudiod daemon. The post includes resources for building a custom fuzzing harness and tools used throughout the research.

Nick shares his experience with signing and notarizing MacOS agents for OpenVox, detailing the challenges posed by Apple's Gatekeeper and the stringent requirements introduced in MacOS 15 Sonoma. He discusses the signing process, the importance of fully signed and notarized binaries, and the need for collaboration within the community to enhance security practices.

MCP Snitch is a macOS application designed for security monitoring and access control of Model Context Protocol (MCP) servers, enabling users to intercept and analyze server communications. It offers features like automatic server discovery, risk assessment, granular control over tool calls, and audit logging, while leveraging AI for threat detection and response monitoring. The application supports secure key storage and compliance through detailed logging of all interactions with MCP tools.

The article discusses a malware issue affecting GitHub users on macOS, highlighting how this malware can compromise systems and steal sensitive information. It emphasizes the importance of maintaining security practices and being aware of potential threats when using software development tools.

Microsoft identified a macOS vulnerability, CVE-2025-31191, allowing attackers to escape the App Sandbox using security-scoped bookmarks without user interaction. The flaw could lead to unrestricted code execution on affected devices, enabling further malicious actions. A fix was provided by Apple in March 2025, and users are advised to apply security updates promptly.

Microsoft has discovered a vulnerability in macOS that allows attackers to bypass TCC protections, potentially exposing sensitive user data. This flaw could enable unauthorized access to applications that are typically restricted by macOS security measures. Users are advised to update their systems to mitigate the risk associated with this vulnerability.