Brief #79: Apple Zero-Days, North Korean Threats, OWASP LLM Risks

Happy Sunday!

I hope this Brief finds you well and ready to tackle the week ahead.

In this edition, I am covering:

• Apple's urgent patch for two zero-day vulnerabilities affecting macOS systems
• OWASP's updated Top 10 LLM Security Risks, with data exposure climbing to second place
• Microsoft's findings on how organizations managing multiple security solutions face increased incidents

And much more.

INDUSTRY NEWS

Fake AI Video Generator Sites Distribute Lumma and AMOS Infostealers

• Threat actors are promoting fake "EditProAI" video generator sites through social media and search results, targeting both Windows and macOS users with infostealers that steal credentials, crypto wallets, and browser data.

• The Windows variant deploys Lumma Stealer using a stolen code signing certificate from Softwareok.com, while macOS systems are targeted with the AMOS malware, both sending stolen data to a command panel at proai[.]club.

• Campaign spreads through deepfake political videos on X (formerly Twitter), leading victims to professional-looking websites at editproai[.]pro (Windows) and editproai[.]org (macOS) that distribute malicious installers.

North Korean Threat Actors Expand Operations with IT Workers and Advanced Exploitation Techniques

• North Korean threat actors have developed sophisticated cryptocurrency theft operations through social engineering, with Sapphire Sleet stealing over $10M in a six-month period by posing as venture capitalists and recruiters.

• DPRK has deployed thousands of IT workers abroad who generate revenue through legitimate work while using stolen identities, AI-generated content, and facilitators to bypass sanctions. These workers have earned hundreds of millions of dollars operating from North Korea, Russia, and China.

• Ruby Sleet has increased targeting of aerospace and defense organizations through sophisticated phishing and supply chain attacks, including compromising legitimate certificates and developing custom malware for specific targets' environments.

Apple Patches Two Zero-Day Vulnerabilities Under Active Exploitation in macOS

• Zero-day vulnerabilities in JavaScriptCore and WebKit components are being actively exploited against Intel-based Mac systems, discovered by Google's Threat Analysis Group.

• The flaws (CVE-2024-44308 and CVE-2024-44309) could allow attackers to execute arbitrary code and perform cross-site scripting attacks through maliciously crafted web content on Intel Mac systems.

• Apple has released urgent security updates across multiple platforms including iOS 18.1.1, macOS Sequoia 15.1.1, and iOS 17.7.2 to address these vulnerabilities, though no specific attack details or IOCs were provided.