Researchers have found a never-before-seen piece of macOS malware that combines a series of clever tradecraft to infect Macs with stealthy, custom-developed credential-stealing code.

The malware is delivered in two stages. The first is distributed in a disk image that masquerades as Maccy, a clipboard manager for Macs. It’s compiled as AppleScript that is notable for the way it delivers the second stage. The malware is named PamStealer because the Rust-written infostealer uses the Pluggable Authentication Modules interface built into macOS to validate the target’s login password before sending it to an attacker-controlled server.

A quieter execution chain

The use of both disk image and AppleScript is common in malware for Macs. More unusual is the way PamStealer combines them to gain stealth. When the AppleScript is double-clicked, it’s opened in the macOS Script Editor, where the malicious functionality is buried deep within the file.

“Rather than relying on shell commands such as curl or zsh, the AppleScript executes a self-contained JavaScript for Automation (JXA) downloader that retrieves and stages the payload using native Objective-C APIs,” researchers from Jamf, a security firm for macOS users, wrote. “Combined with a Rust-based second stage and a password capture workflow that validates credentials locally through PAM, the result is a quieter execution chain than we typically observe in commodity macOS stealers.”

When a user, expecting to install a trustworthy clipboard manager, encounters the disk image, they’re prompted to press Command-R immediately after double-clicking it. This command executes malicious code inside the AppleScript directly. It also allows the execution to bypass com.apple.quarantine, a macOS attribute that provides warnings and restrictions when executable files have been downloaded from the Internet.

As Jamf explained:

PamStealer combines a recently emerging delivery surface with a less familiar payload. While the clickable .scpt and Script Editor lure build on tradecraft that is already gaining adoption across the macOS threat landscape, the malware distinguishes itself through a self-contained JXA dropper, a Rust-based second stage, and a password capture workflow that validates credentials locally through PAM before harvesting them. That second stage puts considerable effort into staying hidden, masquerading as Finder, encrypting its command-and-control traffic, and holding back prompts like the Full Disk Access request for as long as forty minutes so its activity does not line up with launch. Together, these behaviors illustrate how commodity macOS stealers continue to evolve, adopting quieter execution chains and native implementations that reduce traditional detection opportunities while remaining compatible with standard macOS features.

The first stage puts its payload inside an app bundle that impersonates real components built into macOS. The component changes from sample to sample of the malware. Finder.app under com.apple.finder.core or com.apple.finder.monitor, and a Software Update.app under com.apple.security.daemon, are two examples. In either case, they run hidden. They also display macOS’s genuine Finder.icns as its icon.

https://arstechnica.com/security/2026/07/new-pamstealer-macos-malware-uses-clever-tradecraft-to-remain-stealthy/

According to Reuters, the Supreme Court will likely hear the case during its next term, which begins this October.

Apple’s math will likely be challenged

Apple’s filing said that Epic is hoping that the court fight will end with Apple charging a de minimis rate to developers who want to have more control over how transactions are completed in their apps.

In litigation that has been paused during the Supreme Court review, Epic expects to force Apple to show receipts explaining why commission rates are so high.

So far, Apple has claimed that commission fees “ensure that Apple can continue to receive compensation for use of its IP-protected tools, technologies, and services—the very things that attract developers and enable app creation.”

For example, with Epic, Apple claims that purchases like even a single “skin” that Fortnite players buy to make their characters look unique require a fee. Those commissions help Apple develop and update “the iPhone screen that displays it, the iPhone touch controls that direct the virtual character, the Apple silicon chip that processes all iOS software, the app development tools Epic used to build Fortnite for iOS, and the App Store platform that downloads, updates, and maintains the app,” their filing said.

If the Supreme Court sides with Apple and reverses the contempt finding, Apple is hoping to wriggle out of sharing “confidential business data regarding the company’s decision-making concerning the App Store, its implementation of linked-out purchases for developers, and its internal discussions regarding compliance with the injunction.”

Meanwhile, the UK is also hoping to analyze Apple’s actual costs. The CMA has suggested that Apple “could still levy fees” for allowing link-outs, “but that such charges would have to be applied fairly,” the Guardian reported. Like Epic, the Coalition for App Fairness suggested that any app store developer “charges should be justified by ‘transparent data’ from Apple and Google explaining any underlying cost to the tech companies.”

Apple did not immediately respond to Ars’ request to comment.

https://arstechnica.com/tech-policy/2026/06/apple-takes-epic-fight-over-app-store-fees-to-the-supreme-court/

VK Group, the developers of VKontakte and related services, issued its own statement complaining that “Apple has removed VK apps from the App Store without warning or explanation… VK has never been subject to sanctions nor included on sanctions lists, a fact confirmed by numerous legal opinions from international and US counsel. Apple has long been in possession of these official legal opinions and all relevant information. Nevertheless, Apple unilaterally removed VK apps without prior notice… We consider these actions by Apple regarding Russian users to be unjustified and unacceptable.” (Translation from Russian through Google Translate.)

VK Group also stressed that its Android apps “remain fully functional—including updates, notifications, and other features—and are available via RuStore, Google Play, Huawei AppGallery, Samsung Store, Xiaomi Store, and official product websites.”

This appears to be the new line from the Kremlin, as well. A Russian Telegram channel that reports on Peskov’s comments quoted him yesterday as saying that Apple perhaps could not be “trusted as a commercial service provider” and that the blocks are part of a pattern of “decisions by Apple that are, to put it mildly, bizarre.” (Translation from Russian through Google Translate.)

Still, despite the posturing, Peskov knows the score; there’s little Russia can do about the situation. So instead, he ended with an appeal to users. “There is always an immediate solution,” he said, “switch to Android, switch to our systems, switch to our equivalent service, and continue using the services you love.”

https://arstechnica.com/gadgets/2026/06/russian-citizens-told-switch-to-android-after-apple-blocks-key-russian-apps/

Apple bumped its prices across much of its product lineup today, in some cases adding hundreds of dollars to the cost of a new Macintosh. An entry-level MacBook Neo that cost $599 is now $699. The formerly $1,299 iMac will now be a $1,499 iMac. An M5 MacBook Pro that was $1,699 is now $1,999. And at the very high end, an M3 Ultra Mac Studio—which features 96GB of memory—sees a $1,300 price increase to $5,299.

The iPad line is also getting more expensive, between $100 and $200, depending on the model. Smaller price increases have been applied to products like the Apple TV and HomePod. The price of iPhones remains unchanged, at least for now.

The culprit? The soaring price of memory, according to an interview that Apple CEO Tim Cook gave to The Wall Street Journal earlier this month. “Unfortunately, price increases are unavoidable,” Cook told the paper. “We’re doing our best to mitigate the huge increases that are being passed to us, and we’ve been trying to shield our customers from the increases, but the situation has become unsustainable.”

As AI investments rocketed, chipmakers increasingly focused on the more profitable memory used in data centers rather than the memory intended for consumer products.

Consequently, supply shortages and high memory prices have been affecting the tech industry for months now, driving up the prices of many consumer electronics and causing others to disappear from sale. For example, in March, Apple quietly removed a memory-heavy configuration of the M3 Ultra Mac (which featured 512GB of memory) from its store.

For long-time Apple customers who remember how much Apple used to charge for RAM during the PowerPC days, these price rises might induce a little déjà vu.

https://arstechnica.com/apple/2026/06/apple-ratchets-up-prices-blames-the-cost-of-memory/

Security firm Sentinel One has a deeper dive into CVE-2025-20701 here.

Heinze and Steinmetz said last year that the full chain of attacks gave attackers the ability to do other malicious things, including retrieving call history and contacts, and even calling arbitrary numbers. Many of those capabilities are dependent on the specific devices being paired, since the functionality built into them differs from platform to platform.

Devices affected by the Airoha vulnerabilities are by no means alone. In January, researchers disclosed WhisperPair, a series of vulnerabilities that allows an attacker to hijack Bluetooth devices connected through Google Fast Pair, a proprietary protocol belonging to the company. Besides eavesdropping, attackers can exploit the WhisperPair flaws to geolocate devices. The vulnerabilities affect more than a dozen devices from 10 manufacturers, including Sony, Nothing, JBL, OnePlus, and Google itself.

There are few, if any, reports of Bluetooth vulnerabilities like these being actively exploited in the wild. The complexity of such attacks is often high, and an attacker has to continually stay within Bluetooth range of a target while utilizing the exploit. People who think they may be targeted by such attacks should turn off Bluetooth in devices whenever they’re not needed, and remain aware of the risks when Bluetooth is enabled.

https://arstechnica.com/apple/2026/06/apple-patches-high-severity-eavesdropping-vulnerability-in-beats-studio-buds/

Apple has released version 26.5 of all of its operating systems today: iOS 26.5, iPadOS 26.5, macOS 26.5, watchOS 26.5, tvOS 26.5, visionOS 26.5, and version 26.5 of the HomePod software (whew).

None of these are particularly momentous updates, which is pretty normal this late in their lifecycle, but they add a small batch of new features alongside the pile of patches outlined on Apple’s security vulnerabilities page. This is Apple’s first release to support end-to-end encryption for the RCS messaging standard, for example, which, when enabled, can give green-bubble messages some of the same security and privacy advantages that iMessage users have long enjoyed.

Encrypted RCS messaging has a “beta” label in this release, and Apple says it’s limited to a subset of supported cellular carriers. Expanded support “will roll out over time.” Encrypted chats will show up with a padlock icon in the Messages app; if you don’t see a padlock, the message isn’t encrypted, even if you’re using RCS.

Other additions in the 26.5 releases are new Pride-themed wallpapers and some of the initial work needed to support ads in the Apple Maps app. There are also a handful of smaller platform-specific additions and bug fixes, which you can find on Apple’s release notes pages (we’ve linked each in the first paragraph). Apple has been testing several changes to third-party wearable support in the EU to comply with local regulations for several beta cycles now, and those features also arrive for EU iOS users in the 26.5 update.

https://arstechnica.com/gadgets/2026/05/ios-macos-and-ipados-26-5-updates-arrive-with-encrypted-rcs-messaging-and-more/

Trump has made it clear that he is not happy about court-ordered refunds, which some businesses should start receiving next week, Reuters reported. Last month, he cheered news that Apple and Amazon had yet to request refunds, which CNBC reported was due to fears of “offending” Trump. Deeming that response a sign that those companies understood the way Trump operates, he said, “I’ll remember” any companies that “honor” him by letting the US keep the unlawfully collected IEEPA tariffs.

Ars could not reach Apple or Amazon to clarify their positions on IEEPA tariff refunds.

Most likely, Trump is relieved that the international trade court did not require a similar universal injunction or widespread refunds on Section 122 tariffs. Notably, the president had griped that the Supreme Court failed in its opinion to include a line that said, “you don’t have to pay back tariffs that have already been received,” CNBC reported, suggesting that one part of his tariff strategy was to seize as many duties as he could and hope the courts would not order refunds.

No matter what happens with Section 122 refunds, Trump will probably prioritize concluding “two trade investigations under a legal provision known as Section 301” now that future Section 122 tariffs are unavailable, the NYT reported.

Currently, the United States trade representative is holding stakeholder hearings on those investigations, with the last hearing scheduled Friday and new tariffs expected to be announced as soon as this July.

Advocating for narrow tariffs are groups representing tech stakeholders, including the trade group the Consumer Technology Association and the think tank the Information Technology and Innovation Foundation (which Apple “supports”), Politico reported. They’ve urged USTR to narrowly focus on China—rather than all of the US trading partners—when imposing Section 301 tariffs. Otherwise, Trump’s goal of forcing more manufacturing into the US will face impediments, as tech companies will once again be rocked with high costs and supply chain uncertainties, they warned.

“Broad, economy-wide tariffs raise costs for US manufacturers, retailers and consumers while delivering limited enforcement benefits,” CTA’s vice president of international trade, Ed Brzytwa, reportedly testified. “Restricting access or increasing the cost of inputs that aren’t manufactured in sufficient quantities in the United States—or aren’t made here at all—can increase costs, reduce competitiveness and discourage investment in US manufacturing.”

https://arstechnica.com/tech-policy/2026/05/trumps-10-global-tariff-is-illegal-court-rules/

Cook attributes the desktop shortages in part to demand from AI enthusiasts running models locally on Mac hardware—Apple Silicon’s low power usage, good performance, and unified memory pool accessible by both the CPU and GPU have made them popular among these buyers. Combine that with the fact that replacements for these computers are reportedly due soon and that Apple often winds down production of old models before introducing new ones, and you have a recipe for extreme shortages.

The situation with the MacBook Neo is different. For one, it remains much easier to get than either desktop; one ordered now should arrive within two or three weeks. This has generated headlines, but it’s the same shipping estimate Apple was giving a month ago. While I don’t have March data recorded, it appears to be the same shipping estimate Apple was giving two months ago, shortly after the Neo launched.

And unlike the desktops, the Neo remains readily available through third-party retailers like Amazon, Best Buy, and Walmart. Given that the Neo is a play for new Mac owners, it probably makes sense for Apple to prioritize other retailers over its own store. And if Apple isn’t keeping up with demand, it at least isn’t falling farther behind, as it is with the Mac mini and Studio.

That this situation has been so stable for weeks belies the sky-is-falling behind-the-scenes reports of unforeseen demand, component shortages, and falling profit margins that have circulated about the Neo in recent weeks. If those rumors are to be believed, Apple can’t possibly continue to offer the Neo at its current price, and it must therefore be considering cutting the $599/256GB model already. If Apple is struggling this mightily to meet MacBook Neo demand, the company is showing few outward signs of it.

Other small slips: MacBook Air and MacBook Pro

The MacBook Air’s availability remains mostly good, but you’ll wait slightly longer for a 32GB RAM configuration.

Credit: Andrew Cunningham

Though most of Apple’s other computers remain readily available, there are a few places in the lineup where the supply constraints Cook mentioned seem to be taking a toll.

https://arstechnica.com/gadgets/2026/05/were-tracking-423-mac-configurations-to-see-how-apple-is-handling-shortages/

Apple paga per l’AI mancata: chiusa class action negli Stati Uniti dopo il caso Siri e Apple Intelligence

Apple ha accettato di pagare 250 milioni di dollari per chiudere una class action negli Stati Uniti legata ad Apple Intelligence, il sistema di intelligenza artificiale (AI) presentato nel 2024 come il grande salto evolutivo dell’ecosistema iPhone. Al centro della vicenda, raccontata da David McCabe e Kalley Huang sul New York Times, ci sono soprattutto l’assistente virtuale Siri e le funzionalità avanzate di AI che l’azienda aveva promesso agli utenti ma che, secondo i ricorrenti, non erano disponibili al momento del lancio commerciale dei nuovi dispositivi.

L’intesa, depositata davanti alla U.S. District Court del Northern District of California e ancora in attesa di approvazione definitiva da parte del giudice federale, prevede rimborsi diretti compresi tra 25 e 95 dollari per dispositivo agli acquirenti di alcuni modelli di iPhone 16 e iPhone 15 Pro acquistati tra giugno 2024 e marzo 2025.

È uno dei casi più significativi degli ultimi anni sul rapporto tra marketing e intelligenza artificiale nel settore tecnologico, e rappresenta anche un segnale della crescente pressione legale sulle Big Tech che promettono capacità AI ancora immature o non pienamente operative.

Il nodo: le promesse su Siri e Apple Intelligence

La contestazione nasce dalla campagna con cui Apple aveva lanciato Apple Intelligence durante la Worldwide Developers Conference del giugno 2024. In quell’occasione Cupertino aveva presentato la nuova piattaforma AI come la risposta interna a ChatGPT di OpenAI e a Gemini di Google.

Il punto centrale della strategia era il rilancio di Siri: un assistente personale profondamente rinnovato, capace di comprendere il contesto personale dell’utente, leggere email e messaggi, recuperare informazioni dai contenuti presenti sul dispositivo e interagire in modo molto più naturale.

Apple aveva inoltre promesso strumenti avanzati di scrittura automatica, riassunti intelligenti delle notifiche, organizzazione dei contenuti e assistenza contestuale nelle applicazioni di sistema.

Molte di queste funzionalità, però, non erano effettivamente disponibili quando gli iPhone 16 arrivarono sul mercato nel settembre 2024. Apple scelse un rilascio progressivo, distribuendo alcune caratteristiche nei mesi successivi attraverso aggiornamenti software.

Secondo le cause intentate dai consumatori, la società avrebbe però pubblicizzato capacità che “non esistevano ancora”, inducendo milioni di persone ad acquistare nuovi iPhone sulla base di funzioni AI assenti o incomplete.

Uno dei passaggi contenuti negli atti della class action è particolarmente duro: Apple avrebbe “ingannato milioni di consumatori inducendoli a spendere centinaia di dollari per un telefono che non avevano bisogno di acquistare, basandosi su funzionalità inesistenti”.

I problemi tecnici e il ritardo di Siri

Le difficoltà di Apple Intelligence sono emerse rapidamente.
Tra i casi più discussi c’è stato quello dei riassunti automatici delle notifiche, che in alcuni casi alteravano il significato di articoli giornalistici e notizie. Apple è stata costretta a disattivare temporaneamente alcune funzioni dopo le critiche ricevute.

Più delicata ancora la situazione di Siri. Nel marzo 2025 Apple ha rinviato ufficialmente il lancio della nuova versione avanzata dell’assistente vocale, citando problemi qualitativi e affidabilità insufficiente.

Il rinvio ha confermato ciò che molti analisti sospettavano: Apple era entrata nella corsa all’intelligenza artificiale generativa in ritardo rispetto ai concorrenti.

A differenza di Microsoft, Google o OpenAI, Cupertino non disponeva infatti di grandi modelli linguistici proprietari già maturi. La strategia iniziale puntava soprattutto sull’integrazione hardware-software e sull’elaborazione locale dei dati per preservare la privacy degli utenti, ma lo sviluppo delle capacità conversazionali si è rivelato più complesso del previsto.

Non è un caso che nel gennaio 2025 Apple abbia annunciato l’integrazione di Gemini di Google all’interno dei propri servizi AI, inclusa Siri. Una scelta che, fino a pochi anni fa, sarebbe stata difficilmente immaginabile per una società storicamente ossessionata dal controllo verticale della propria tecnologia.

Il cambio ai vertici

Le difficoltà hanno avuto conseguenze anche sul management. Nel dicembre 2024 Apple ha annunciato l’uscita di scena di John Giannandrea, il manager arrivato da Google nel 2018 per guidare la strategia sull’intelligenza artificiale. Giannandrea era stato considerato il simbolo dell’ambizione AI di Cupertino, ma il ritardo accumulato rispetto ai concorrenti ha indebolito la sua posizione interna.

Nel frattempo il mercato finanziario ha premiato in modo netto le aziende che hanno investito aggressivamente nell’intelligenza artificiale generativa. Microsoft e Nvidia hanno visto crescere enormemente la propria capitalizzazione grazie alla spinta dell’AI, mentre Apple ha mantenuto un approccio più prudente e graduale.

Il caso Apple Intelligence mostra però anche il rischio opposto: promettere troppo presto funzioni non ancora mature.

Apple nega ogni illecito, ma intanto c’è l’accordo da 250 milioni

Nel quadro dell’accordo transattivo, Apple continua formalmente a negare qualsiasi illecito. “Dal lancio di Apple Intelligence abbiamo introdotto decine di funzionalità in molte lingue integrate nelle piattaforme Apple”, ha dichiarato Marni Goldberg, portavoce dell’azienda, che ha aggiunto: “Abbiamo risolto questa vicenda per restare concentrati su ciò che sappiamo fare meglio: offrire i prodotti e i servizi più innovativi ai nostri utenti”.

Dal punto di vista finanziario, 250 milioni di dollari rappresentano una cifra relativamente contenuta per una società che genera oltre 90 miliardi di dollari di utili annui. Diciamo che la rilevanza dell’accordo sta nel suo alto valore simbolico: per la prima volta, uno dei principali colossi tecnologici globali accetta di risarcire direttamente i consumatori per promesse considerate eccessive sulle capacità dell’intelligenza artificiale.

È un precedente che potrebbe avere conseguenze importanti su tutto il settore. Negli ultimi due anni le Big Tech hanno accelerato la comunicazione sull’AI spesso presentando prototipi o funzioni sperimentali come esperienze già pronte per il mercato. Non sempre però le cose vanno per il verso giusto e una grande opportunità di profitto si trasforma rapidamente in un grattacapo legale e reputazionale.

Leggi le altre notizie sull’home page di Key4biz

https://www.key4biz.it/niente-ai-su-siri-apple-rimborsa-250-milioni-di-dollari-ai-possessori-di-iphone/572017/

Apple CEO Tim Cook announced this week that he’s stepping down from his position in September and handing the reins to John Ternus, currently the company’s senior vice president of Hardware Engineering and a 25-year employee.

This change had been telegraphed pretty far in advance, both by media reports (Bloomberg’s well-connected Mark Gurman flagged Ternus as a frontrunner in May 2024, and The New York Times gave him a glossy profile in January) and by Apple (when it announced the MacBook Neo last month, it was Ternus, not Cook, who delivered the prepared remarks).

I’ve been covering Apple for various outlets throughout Cook’s tenure as CEO, and I’ve been thinking a lot about how Apple has changed in the 15 years since he formally took over from an ailing Steve Jobs in the summer of 2011. Under Cook, the company has become less surprising but massively financially successful; some of Apple’s newer products have flopped or underperformed, but far more have become and stayed excellent thanks to years of competent iteration.

This isn’t a comprehensive list of everything Cook has done as CEO, but it’s my attempt at a big-picture, high-level summary and a snapshot of where Apple is now, to serve as a comparison point once Ternus kicks off his tenure.

Quiet hardware successes: Apple Watch, headphones, and more

Some of Apple’s best, most successful all-new hardware under Cook have been accessories like AirPods and the Apple Watch.

Credit: Apple

The Tim Cook era can’t lay claim to any single hardware announcement as important or far-reaching as the iPhone, the iPod, or even the iPad. Apple has definitely introduced good—even great—hardware in the last 15 years, though.

The main difference is that Apple products introduced during the Jobs era tended to belong at or near the center of your digital life. The Macintosh popularized the graphical user interface. The iPod was a constant musical companion on commutes, during workouts or study sessions, or when plugged into someone’s speaker at a party. The iPhone, obviously, became the most important personal computing device since the personal computer. And the iPad, as conceived by Jobs, was clearly intended to be a new kind of primary computing device (it was only under Cook that the iPad settled into its current in-betweener rut, computer-like but not computer-like enough to supplant the Mac’s mouse-and-pointer usage model).

https://arstechnica.com/gadgets/2026/04/six-things-ill-remember-when-i-think-about-tim-cooks-version-of-apple/