Threat Advisories:

SessionReaper Flaw Enables Seamless Session Hijacking on Adobe Commerce CVE‑2025‑61932: Critical Lanscope Endpoint Manager Flaw Actively Exploited Lazarus Targets Europe’s UAV Innovation October 2025 Linux Patch Roundup MuddyWater Deploys Phoenix Backdoor in Targeted Espionage Campaign Critical Cloud Threat: Azure Blob Storage Under Active Attack Operation Silk Lure Scam: When Job Hunts Leads to Malware Storm-1175’s Masterstroke Exploits CVE-2025-10035 in GoAnywhere MFT F5 BIG-IP Breach: Nation-State Hackers Expose Source Code and Undisclosed Flaws Microsoft’s October 2025 Patch Tuesday TA585 Leverages ClickFix Technique and MonsterV2 Malware Astaroth Targets Brazil Using GitHub Infrastructure CVE-2025-11371: Unpatched Gladinet Flaw Actively Exploited in the Wild Stealit’s New Trick: Packing Malware Inside Node.js Single Executables Hidden in Plain Sight: The Abuse of Nezha and the Ghost RAT That Followed UTA0388: AI-Powered Targeted Operations Leveraging GOVERSHELL Zimbra Zero-Day Hidden in “Harmless” ICS File Targets Military Service Finder Plugin Flaw Opens Door to Full Site Compromise Redis Under Siege: RediShell Flaw Opens Door to Remote Code Execution CVE-2025-61882: Oracle EBS Zero-Day Actively Exploited in the Wild

Highlights of Our CISO Dinner

Upgrading struggling vulnerability management programs to Threat Exposure Management, with Host, CISO Al Lindseth formerly from Plains All American Pipeline and PWC - 6 minute podcast

0:00

0:00

Play Count: Loading...

Partner Program

Book a Demo Threat Digest - Subscribe

XCSSET malware exploits zero day TCC vulnerability in MacOS

Threat Level – Red | Vulnerability Report

For a detailed advisory, download the pdf file here.

A zero-day vulnerability (CVE-2021-30713) in the latest macOS was exploited by XCSSET malware which allows an attacker to bypass the Transparency Consent and Control (TCC) framework and gives unauthorized access to the microphone, webcam, recording the screen, or even taking screenshots on infected Macs without prompting for user approval .The MITRE technique used by the adversary is T1222.

Vulnerability Details

Indicators of Compromise

Patch Links

https://support.apple.com/en-us/HT212529

References

https://support.apple.com/en-us/HT212529
https://threatpost.com/apple-patches-zero-day-flaw-in-macos-that-allows-for-sneaky-screenshots/166428/
https://www.ehackingnews.com/2021/05/apple-fixes-macos-zero-day.html
https://www.jamf.com/blog/zero-day-tcc-bypass-discovered-in-xcsset-malware/
https://www.darkreading.com/threat-intelligence/macos-zero-day-let-attackers-bypass-privacy-preferences/d/d-id/1341131
https://www.reviewgeek.com/85025/a-new-macos-update-patches-0-day-exploit-that-let-hackers-screenshot-on-your-mac/
https://vuldb.com/?id.175760

What’s new on HivePro

Get through updates and upcoming events, and more directly in your inbox