TechCapsules

Politician who investigated spyware abuses had his phone hacked with Pegasus spyware

A European politician, Stelios Kouloglou, had his phone hacked with Pegasus spyware while serving on a committee investigating spyware abuses. The hacking occurred in 2022 and 2023, with the spyware exploiting a security vulnerability in Apple's iPhone software. This is the first time a member of the European Parliament's PEGA committee has been publicly identified as a victim of spyware. The hacking has reignited controversy over governments abusing spyware to collect information about critics. The Citizen Lab researchers did not attribute the hacking to a specific country, but noted the government customer used the same Pegasus-loaded email address as in a previous campaign. The hacking has sparked calls for the European Commission to take action, with one lawmaker describing it as a "direct attack on the rule of law." The incident raises questions about how governments use spyware, ostensibly for identifying serious crime, but often targeting journalists, lawmakers, and critics.

💡 The hacking of Kouloglou's phone exposes the vulnerability of even high-profile targets to spyware attacks, undermining trust in government oversight. It also highlights the need for stricter regulations on spyware use, particularly among government agencies.

New malicious clipboard clone raises serious security concerns for Mac users

Macworld reports that Jamf Threat Labs identified PamStealer, a new macOS malware targeting users of the Maccy clipboard manager through fake websites distributing malicious AppleScript files. The sophisticated malware uses a quiet execution chain with JXA and Rust to steal login passwords via macOS Pluggable Authentication Modules, making detection difficult. Users are advised to only download Maccy from the official maccy.app website or GitHub and avoid suspicious links. Jamf Threat Labs has issued a report on the new malware, warning users of the third-party clipboard manager Maccy of the potential threat.

💡 The evolution of PamStealer highlights the growing sophistication of macOS malware, with attackers adopting quieter execution chains and native implementations that evade traditional detection methods. This development underscores the importance of vigilance and caution when downloading software from third-party websites, even if they appear legitimate.

QNu Labs Partners with SAGA Consultants to Expand Quantum Security Services

QNu Labs and SAGA Consultants have formed a strategic partnership to expand the global adoption of quantum-safe cybersecurity solutions. The collaboration combines QNu Labs' quantum cybersecurity technologies with SAGA Consultants' consulting expertise to support enterprises, governments, and critical infrastructure organizations. The partners aim to accelerate quantum readiness by promoting quantum-secure communications, cryptographic security, and post-quantum cybersecurity solutions. This partnership brings together QNu Labs' expertise in quantum cryptography and SAGA Consultants' deep consulting capabilities to strengthen cyber resilience in an increasingly complex threat landscape.

New Mac infostealer confirms stolen passwords before stealing data

Researchers at Jamf Threat Labs have discovered a new macOS infostealer called PamStealer, which verifies Mac login passwords before stealing sensitive data. PamStealer disguises itself as the Maccy clipboard manager and uses AppleScript alongside a Rust payload to infect Macs. The malware campaign starts with a fake website imitating the legitimate Maccy clipboard manager, delivering a malicious AppleScript application. PamStealer confirms the validity of stolen passwords through Apple's Pluggable Authentication Modules, setting it apart from other macOS infostealers. This unique feature allows attackers to immediately confirm compromised credentials. The discovery highlights a new threat to macOS users.

💡 PamStealer's password verification capability gives attackers a significant advantage in exploiting stolen credentials. It enables them to focus on high-value targets with confirmed valid login information.

Apple hasn’t fixed a Hide My Email privacy bug in over a…

Apple's "Hide My Email" feature, designed to protect users' email addresses from spam and unwanted communication, has a vulnerability that allows attackers to discover real email addresses. The issue was reported to Apple in June 2025, but it remains unfixed over a year later. Apple is aware of the problem and has acknowledged investigating it, but no fix has been implemented. The vulnerability affects users who rely on Hide My Email for secure communication.

💡 Apple's failure to address the vulnerability raises concerns about the security of its users' personal information. The issue highlights the potential risks of relying on a feature that is not foolproof, and may lead users to question the effectiveness of Hide My Email in protecting their email addresses.

New Jamf Beacon gives businesses active Mac threat hunting

Organizations can now enhance their Mac security with Jamf Beacon, a service designed to detect attacks that traditional security tools may miss. The service, tailored for unique-to-Mac situations and threats, uses detection rules developed specifically for macOS and continuously analyzes customer telemetry for attacker techniques and unusual behavior. Jamf Beacon targets threats such as trojanized software packages, malicious Visual Studio Code and Xcode projects, and malware spread through fake job offers. The service provides analysis and remediation guidance while organizations decide how to respond according to their own security policies.

💡 The growing prevalence of macOS attacks in enterprise environments highlights the need for specialized security expertise. By offering a service that identifies threats that conventional security tools may overlook, Jamf Beacon fills a critical gap in Mac security, making it a valuable tool for organizations seeking to protect their macOS systems.