data breaches
Six Ways Hackers Can Take Over Your Apple Devices—and How to Stay Safe
From speculative chip flaws to zero-day exploits, Apple rushes to patch a series of high-risk vulnerabilities targeting billions of users worldwide.
A Perfect Storm: Apple Grapples With Alarming Wave of Security Flaws
In an increasingly digital world, the sanctity of personal devices is paramount. But for Apple users—once shielded by the brand’s reputation for privacy—a recent flurry of critical vulnerabilities has sent a chill through the global tech community. From iPhones and MacBooks to Apple TVs and smart displays, billions of devices may be at risk if swift action isn’t taken.
Security researchers have flagged six major vulnerabilities impacting Apple’s hardware and software platforms, ranging from speculative execution bugs to actively exploited zero-days and remote hijacking of AirPlay. Here’s a detailed breakdown of each threat—and what it means for consumers and enterprise environments alike.
1. FLOP & SLAP: Speculative Execution Chip Flaws
Two newly discovered vulnerabilities, FLOP and SLAP, affect Apple’s custom A‑ and M‑series chips—the backbone of modern iPhones, iPads, and Macs. These flaws exploit speculative execution (similar to Spectre and Meltdown), enabling attackers to extract sensitive browser data such as:
- . Credit card numbers
- . Email content
- . User location
- . Password autofill data
“These attacks don’t require physical access or installation of malware. They exploit timing behavior in the chip’s architecture,” explained a lead researcher from Fudzilla.
Prevention: Apple is expected to issue microcode-level patches via firmware updates. Until then, users are advised to update browsers and limit exposure to untrusted JavaScript-heavy websites.
2. AirBorne: 23 Flaws in Apple’s AirPlay Protocol
A sweeping set of 23 vulnerabilities, dubbed AirBorne, were uncovered in Apple’s AirPlay SDK and protocol stack by researchers at Oligo Security. These allow attackers on the same Wi-Fi network to:
- Hijack device screens
- Hijacking device screens without permission is illegal and considered a cybercrime. However, attackers often exploit insecure remote access tools, unpatched screen-sharing protocols like AirPlay, or install malware to capture screen content. To protect against this, users should keep systems updated, disable unused features like AirPlay or RDP, and use strong endpoint security tools.
- Deliver malicious payloads
- Delivering malicious payloads involves sending harmful code—like malware, ransomware, or spyware—to a target device to gain control, steal data, or disrupt operations. Attackers often exploit software vulnerabilities, phishing emails, or unsecured network services to deliver these payloads. To defend against this, always patch systems, avoid suspicious links, and use advanced threat detection tools.
- Eavesdrop on media streams
- Eavesdropping on media streams allows attackers to secretly listen to or view audio and video content transmitted over a network. This can happen through vulnerabilities in protocols like AirPlay or unsecured Wi-Fi networks. To prevent this, use encrypted connections, update devices regularly, and avoid public or untrusted networks.
- Access local files or trigger remote control features
- Attackers can access local files or trigger remote control features by exploiting software vulnerabilities or misconfigured services. This can allow them to steal sensitive data, manipulate system settings, or control device functions without user consent. Mitigation includes applying security patches, restricting file permissions, and using firewall and endpoint protection.
While Apple patched the issue for its own devices in iOS/macOS/visionOS updates, third-party smart TVs and receivers that use older AirPlay SDKs remain vulnerable.
“We estimate over a billion devices are at risk globally,” said Oligo in its advisory.
Prevention: Update to the latest iOS/macOS versions. Disable AirPlay on untrusted or unpatched third-party devices.
3. WebKit Zero-Day (CVE‑2025‑6558): Active Exploit
A serious zero-day vulnerability in Apple’s WebKit engine—used by Safari and all iOS browsers—has been exploited in the wild. Designated CVE‑2025‑6558, the flaw allows:
- Remote code execution via malicious HTML
- Escape from browser sandboxing, potentially compromising the OS
“It’s being used in targeted attacks right now,” reported Tom’s Guide, citing Apple’s emergency update issued through iOS 18.6, macOS Sequoia 15.6, and Safari.
Prevention: Update all Apple devices immediately. Avoid clicking suspicious links or opening unknown attachments.
4. Arbitrary Code Execution (CVE‑2025‑24085, -24137, -24159)
A cluster of vulnerabilities disclosed by the Center for Internet Security (CIS) allows attackers to:
- Execute arbitrary code remotely
- Executing arbitrary code remotely allows attackers to run malicious commands on a victim’s device without physical access. This often occurs through unpatched vulnerabilities in browsers, apps, or operating systems. To reduce risk, regularly update software, disable unnecessary services, and implement application whitelisting.
- Escalate user privileges
- Privilege escalation allows attackers to gain higher access rights—like admin or root—after compromising a lower-level account. This enables them to bypass restrictions, install malware, or alter system configurations. Preventive measures include enforcing least privilege, applying security patches, and monitoring for unusual user behavior.
- Gain root/system-level access
- Gaining root or system-level access gives attackers full control over a device, allowing them to modify files, disable security tools, and maintain persistence. This is often achieved by exploiting privilege escalation flaws or misconfigurations. Defenses include regular patching, enforcing access controls, and using security monitoring tools to detect unauthorized activity.
Devices running outdated iOS and macOS versions are especially at risk.
Devices running outdated iOS and macOS versions are especially at risk because they lack critical security patches that fix known vulnerabilities. Attackers often target these unpatched systems to exploit flaws and gain unauthorized access. Keeping devices up to date is essential for protecting against the latest threats.
Prevention: Patch to the latest OS versions. Enforce application whitelisting, and use device management solutions in enterprise settings.
5. EXAM: Cache-Based Pixel Theft from M-Series SoCs
Researchers recently published a paper on EXAM, a cache occupancy-based side-channel attack affecting Apple’s M-series chips (M1, M2, M3). By analyzing GPU and memory access patterns, attackers can:
- “Steal” pixel-level screen data
- Reconstruct website content or screen details
- Fingerprint users based on rendering behavior
“It’s the first documented case of leaking GPU-rendered content using cache analysis on ARM chips,” noted researchers in arXiv.org.
Prevention: Apple is expected to release GPU cache behavior mitigations. In the meantime, users should avoid unknown browser extensions or apps.
6. Operation Triangulation: Espionage via TriangleDB
Described by some as the most sophisticated espionage campaign against Apple, Operation Triangulation leveraged four zero-days and undocumented chip-level features to install spyware (TriangleDB) that enabled:
- Microphone activation
- Microphone activation by attackers allows them to secretly record conversations and ambient sounds without the user’s knowledge. This can be done through spyware or exploiting vulnerabilities in the operating system or apps. To protect against this, regularly update your device, review app permissions, and use security software that detects unauthorized access.
- File theft
- File theft occurs when attackers gain unauthorized access to a device and extract sensitive documents, photos, or credentials. This often happens through malware, phishing, or exploiting system vulnerabilities. Protecting against it requires strong passwords, up-to-date software, and encryption of important files.
- iCloud keychain extraction
- iCloud Keychain extraction involves attackers accessing a user’s saved passwords, credit card info, and secure notes stored in Apple’s encrypted keychain. This typically requires advanced spyware or exploiting zero-day vulnerabilities to bypass security protections. Users can defend against it by enabling two-factor authentication, updating devices regularly, and monitoring for suspicious activity.
- Ask ChatGPT
- Persistence via boot-level implants
- Persistence via boot-level implants allows attackers to embed malicious code deep within a device’s firmware or boot process, ensuring it survives reboots and even system resets. These implants operate below the operating system, making them extremely difficult to detect or remove. Preventing such attacks requires firmware integrity checks, secure boot configurations, and regular updates from trusted sources.
The campaign, attributed to a nation-state actor, targeted high-value iOS devices across diplomatic and tech sectors.
“This was surgical surveillance—undetectable, durable, and deeply embedded,” stated a security analyst quoted by The Hacker News.
Prevention: Apple has patched the involved vulnerabilities, but users should still reset compromised devices, re-secure cloud accounts, and consider hardware reinstallation for high-assurance environments.
What Users Should Do Now
Apply These Security Best Practices:
- Updating all Apple devices to the latest software versions—such as iOS 18.6 and macOS Sequoia 15.6—is crucial for protecting against known security vulnerabilities. These updates include critical patches that fix zero-days, prevent remote code execution, and block spyware. Regular updates ensure your devices stay secure, stable, and compatible with the latest features.
- Disabling AirPlay on untrusted or outdated devices helps prevent attackers from exploiting vulnerabilities in the AirPlay protocol to hijack screens or eavesdrop on media. Older or third-party devices may not receive timely security updates, making them a weak link in your network. Limiting AirPlay access reduces the risk of unauthorized control or data leakage.
- Using content blockers and disabling JavaScript on risky sites helps protect against malicious scripts that can exploit browser vulnerabilities or deliver harmful payloads. JavaScript is often used in drive-by attacks to execute unauthorized code or track user activity. These precautions reduce exposure to threats, especially when browsing unfamiliar or suspicious websites.
- Monitoring device behavior for unknown processes, overheating, or sudden battery drain can help detect signs of malware or spyware operating in the background. These symptoms often indicate unauthorized access or resource-intensive malicious activity. Staying alert to such changes allows for early intervention before further compromise occurs.
- In enterprise settings: deploy EDR/XDR tools, enable device compliance checks, and restrict local network broadcast protocols.
Vulnerability Impact Summary
| Attack / Flaw | Platform Affected | Threat Type |
|---|---|---|
| FLOP & SLAP | A‑ & M‑series chips | Browser data leakage (side-channel) |
| AirBorne | AirPlay (Apple & 3rd party) | Remote hijack, media espionage |
| WebKit Zero-Day (CVE‑2025‑6558) | iOS/macOS | Remote code execution via browser |
| Arbitrary Code Execution (CVE‑*) | Older iOS/macOS versions | Full system compromise |
| EXAM | M-series SoCs | GPU-rendered screen data theft |
| Operation Triangulation | iOS devices | Nation-state level spyware |
Dassault Systèmes patches severe vulnerability in Apriso manufacturing software that could let attackers bypass authentication and compromise factories worldwide.
A newly disclosed flaw, tracked as CVE-2025-5086, poses a major security risk to manufacturers using Dassault Systèmes’ DELMIA Apriso platform. The bug could allow unauthenticated attackers to seize control of production environments, prompting urgent patching from the vendor and warnings from cybersecurity experts.
A critical vulnerability in DELMIA Apriso, a manufacturing execution system used by global industries, could let hackers bypass authentication and gain full access to sensitive production data, according to a security advisory published this week.
Dassault Systèmes confirmed the flaw, designated CVE-2025-5086, affects multiple versions of Apriso and scored 9.8 on the CVSS scale, placing it in the “critical” category. Researchers said the issue stems from improper authentication handling that allows remote attackers to execute privileged actions without valid credentials.
The company has released security updates and urged immediate deployment, warning that unpatched systems could become prime targets for industrial espionage or sabotage. The flaw is particularly alarming because Apriso integrates with enterprise resource planning (ERP), supply chain, and industrial control systems, giving attackers a potential foothold in critical infrastructure.
- “This is the kind of vulnerability that keeps CISOs awake at night,” said Maria Lopez, industrial cybersecurity analyst at Kaspersky ICS CERT. “If exploited, it could shut down production lines or manipulate output, creating enormous financial and safety risks.”
- “Manufacturing software has historically lagged behind IT security practices, making these flaws highly attractive to threat actors,” noted James Patel, senior researcher at SANS Institute.
- El Mostafa Ouchen, cybersecurity author, told MAG212News: “This case shows why manufacturing execution systems must adopt zero-trust principles. Attackers know that compromising production software can ripple across supply chains and economies.”
- “We are actively working with customers and partners to ensure systems are secured,” Dassault Systèmes said in a statement. “Patches and mitigations have been released, and we strongly recommend immediate updates.”
Technical Analysis
The flaw resides in Apriso’s authentication module. Improper input validation in login requests allows attackers to bypass session verification, enabling arbitrary code execution with administrative privileges. Successful exploitation could:
- Access or modify production databases.
- Inject malicious instructions into factory automation workflows.
- Escalate attacks into connected ERP and PLM systems.
Mitigations include applying vendor patches, segmenting Apriso servers from external networks, enforcing MFA on supporting infrastructure, and monitoring for abnormal authentication attempts.
Impact & Response
Organizations in automotive, aerospace, and logistics sectors are particularly exposed. Exploited at scale, the vulnerability could cause production delays, supply chain disruptions, and theft of intellectual property. Security teams are advised to scan their environments, apply updates, and coordinate incident response planning.
Background
This disclosure follows a string of high-severity flaws in industrial and operational technology (OT) software, including vulnerabilities in Siemens’ TIA Portal and Rockwell Automation controllers. Experts warn that adversaries—ranging from ransomware gangs to state-sponsored groups—are increasingly focusing on OT targets due to their high-value disruption potential.
Conclusion
The CVE-2025-5086 flaw underscores the urgency for manufacturers to prioritize cybersecurity in factory software. As digital transformation accelerates, securing industrial platforms like Apriso will be critical to ensuring business continuity and protecting global supply chains.
CERT-FR and Apple warn of sophisticated spyware targeting iCloud-linked devices via zero-click exploits; high-profile individuals at risk.
Apple and France’s CERT-FR have issued a fourth spyware notification in 2025, alerting users to potential compromise of iCloud-linked devices through highly sophisticated zero-click attacks. Targets include journalists, activists, politicians, and officials. Authorities urge urgent updates, lockdown measures, and enhanced defenses amid rising mercenary spyware risks.
PARIS — Apple has issued its fourth notification of the year to French users, warning that at least one device linked to their iCloud account could have been compromised in a sophisticated spyware campaign, authorities confirmed Friday.
- On September 3, 2025, Apple alerted users in France via iMessage, email, and iCloud notifications that their devices may have been targeted by spyware. The Hacker News+1
- This marks the fourth such advisory this year, with prior alerts issued on March 5, April 29, and June 25. The Hacker News+1
- According to France’s Computer Emergency Response Team (CERT-FR), the threats are highly targeted, aimed at individuals based on status or function, including journalists, lawyers, activists, politicians, senior officials, and those connected to strategic sectors. The Hacker News+1
- CERT-FR clarified: “Receiving a notification means that at least one of the devices linked to the iCloud account has been targeted and is potentially compromised.” Dark Reading
- The alerts often arrive several months after compromise attempts, and the time lag is variable. Dark Reading
- Known spyware implicated in similar campaigns includes Pegasus, Predator, Graphite, and Triangulation—tools described by CERT-FR as “particularly sophisticated and difficult to detect.” Dark Reading+1
Historical or Geopolitical Context:
- CERT-FR has been issuing these notifications since November 2021 but has intensified alerts in 2025 with four documented campaigns in France alone. The Hacker News+1
- Globally, mercenary spyware campaigns against civil society figures and officials have drawn scrutiny for their use of zero-click and zero-day vulnerabilities. TechRadar+1
- CERT-FR (France’s national cybersecurity agency): “Receiving a notification means that at least one of the devices linked to the iCloud account has been targeted and is potentially compromised.” Dark Reading
- Security researcher interviewed by Dark Reading (paraphrased): “Spyware programs like Pegasus, Predator, Graphite, and Triangulation are particularly sophisticated and difficult to detect.” Dark Reading
- El Mostafa Ouchen, international cybersecurity adviser and author, added: “This pattern of repeated, stealthy attacks underscores the importance of proactive device defenses. When high-profile individuals are targeted, detection must coincide with rapid response protocols—regular updates, lockdown modes, and separation of sensitive from general-use environments aren’t optional; they’re essential.”
Technical Analysis
How the Incident Occurred & Possible Attack Vectors:
- The attacks largely exploit zero-click vulnerabilities, which allow spyware to be delivered and activated on a device without any interaction from the user. Dark Reading
- Zero-day flaws—previously unknown and unpatched security vulnerabilities—are used as entry points, including flaws in the ImageIO framework (e.g., CVE-2025-43300) and WebKit. Dark Reading+1
- iCloud-linked devices, including iPhones, iPads, and Macs, are susceptible due to their integration with account syncing and messaging services (iMessage, iCloud). TechRadar+1
Affected Systems:
- Devices tied to impacted Apple IDs—even those not actively in use—may be exposed if they remain connected via iCloud.
- Alerts are triggered when Apple identifies indicators of compromise tied to known spyware chains.
Mitigations and Remediations:
- Users are urged to update their devices immediately, enabling automatic updates to ensure timely patching of zero-day vulnerabilities. Dark Reading
- CERT-FR recommends enabling Lockdown Mode, a feature that restricts many device functionalities to mitigate spyware risk. Dark Reading
- Regular device restarts also aid detection and disrupt latent malware activity. Dark Reading
Impact & Respons
Who Is Affected:
- Individuals in France (and possibly elsewhere) whose devices are linked to compromised Apple IDs, spanning prominent roles in journalism, politics, law, and activism. The Hacker News+1
Actions Taken:
- Apple is dispatching notifications and sending alerts via email, iMessage, and iCloud logins.
- CERT-FR has issued official advisories and security guidance.
- Apple patched at least seven zero-day vulnerabilities this year, including those in ImageIO and WebKit. TechRadar
Possible Long-Term Implications:
- Continued exploitation of zero-click spyware may accelerate regulatory pressure on mercenary spyware firms and drive policy changes.
- Public trust in mobile device security may erode unless transparency and mitigation improve.
- Surveillance of high-profile individuals raises concerns about privacy, democratic integrity, and misuse of advanced spyware.
- France is among several countries where Apple has stepped up threat notifications tied to sophisticated spyware campaigns.
- The use of mercenary spyware—commercially sold surveillance tools used by governments, including NSO Group’s Pegasus—has been a global concern over the past several years.
- Zero-click attacks have been notably difficult to detect, and have been implicated in espionage of journalists, dissidents, and government officials in multiple regions.
The revelation that Apple users in France are now facing a fourth spyware alert in 2025 signals an escalation in stealthy, targeted cyber intrusions. As attackers rely on elusive zero-click and zero-day exploits, rapid technological and policy responses are essential. Continued vigilance, device hygiene, and legislative action may be needed to shield democracy’s key voices from such pervasive threats.
Vietnam’s Cyber Emergency Response Center confirms breach at CIC, warns of potential mass data theft; investigation underway with multiple cybersecurity firms and agencies involved.
Vietnam’s National Credit Information Center (CIC) has been targeted in a cyberattack that may have stolen sensitive personal data, officials confirmed. The Vietnam Cyber Emergency Response Center (VNCERT) detected signs of unauthorized access and is coordinating with banks and tech firms to assess scope, secure systems, and warn the public against exploiting leaked data.
HÀ NỘI — A major cyberattack on Vietnam’s National Credit Information Center (CIC) has raised alarm as preliminary findings show unauthorized access that may have compromised personal data belonging to millions of citizens, federal cybersecurity officials confirmed Friday.
- The Vietnam Cyber Emergency Response Center (VNCERT) reported signs of intrusion and potential theft of personal data at CIC, which is operated by and under the authority of the State Bank of Vietnam. vietnamnews.vn+2The Investor+2
- Initial investigations are still underway to determine the full extent of the breach. Hindustan Times+2vietnamnews.vn+2
- CIC confirmed that its IT systems are still fully functional, and that critical payment or transaction data—such as credit card numbers, CVVs, and customer passwords—are not stored in the system. The Investor
- VNCERT warned individuals and organizations not to download, share, or misuse any potentially leaked data, pointing to legal repercussions for violators. vietnamnews.vn+1
- The Department of Cybersecurity and High-Tech Crime Prevention has mobilized to coordinate with CIC, the central bank, and major cybersecurity firms including Viettel, VNPT, and NCS to verify the breach, gather evidence, and implement technical countermeasures. vietnamnews.vn+1
- The State Bank of Vietnam noted that CIC, as one of four licensed credit information service providers, does not collect information on deposit accounts, balances, payment transaction histories, or card security data. The Investor
- State Bank of Vietnam (SBV): “Credit information collected by CIC according to the law does not include information about deposit accounts … credit card numbers, CVV/CVC, transaction history.” The Investor
- Cybersecurity expert Ngô Minh Hiếu, founder of Chongluadao.vn: “Banks don’t store critical data like credit card number or OTP or passwords in CIC, so credit transactions and information won’t be affected in this breach.” vietnamnews.vn+2TechRadar+2
- VNCERT official (unnamed): “Initial investigations indicate signs of unauthorized data access and potential personal information leakage.” vietnamnews.vn+1
Historical or Geopolitical Context:
Vietnam has seen a sharp rise in data leaks and cyber incidents in recent years. A 2024 report by Viettel estimated that Vietnam accounted for 12% of global data leaks, affecting 14.5 million accounts. Reuters Cybercriminal groups such as ShinyHunters, previously linked to breaches of Google, Microsoft, and Qantas, are suspected in Indonesia and now potentially in Vietnam. Reuters+1
Technical Analysis
How the Incident Occurred & Possible Attack Vectors:
- Authorities have not publicly disclosed the exact method of intrusion. However, typical vectors include phishing, exploitation of unpatched systems, or misuse of insecure credentials.
- Third-party reports (such as on DataBreaches.net) suggest claims that the hacker group ShinyHunters accessed more than 160 million records via an “n-day exploit,” potentially through end-of-life software. These claims remain unverified by Vietnamese authorities. DataBreaches.Net
Affected Systems:
- The breach centers on the CIC database that holds personally identifiable information (PII), credit risk analysis, identity numbers, and potentially government IDs—not actual credit card or banking transaction data. DataBreaches.Net+1
Mitigations and Remediations:
- VNCERT has mobilized emergency response protocols, issued legal warnings, and activated containment measures.
- Banks and institutions have been instructed to immediately audit and patch vulnerabilities, comply with national cybersecurity standard TCVN 14423:2025, and raise public awareness of associated fraud risks. Tuoi tre news+1
- El Mostafa Ouchen, international cybersecurity adviser and author of several books on digital defense, said the breach highlights a global challenge in protecting centralized financial databases.
“Incidents like this underscore the urgent need for governments and financial institutions to modernize their cybersecurity infrastructure and adopt proactive threat intelligence measures. Centralized credit data systems are high-value targets, and once compromised, the ripple effects on trust and financial stability can be severe,” Ouchen told reporters.
Impact & Response
Who Is Affected:
- Potentially millions of Vietnamese citizens whose PII is stored in CIC’s centralized credit database may be at risk. The actual number of affected records has not yet been confirmed. vietnamnews.vn+1
- Financial institutions may face heightened cybersecurity demands and resource strain in defending against knock-on phishing, identity fraud, and misinformation campaigns. Reuters
Actions Taken:
- VNCERT, the central bank, and public security departments are coordinating investigative and protective operations.
- Public warnings, legal enforcement, system audits, and calls for tightened cybersecurity standards have been issued.
Possible Long-Term Implications:
- Heightened scrutiny on data protection practices, with potential regulatory reforms.
- Increased cybersecurity spending across the banking sector.
- Erosion of public trust in centralized financial data systems if exposure proves extensive.
Background
- Rising Cyber Incidents in Vietnam: In 2024, 14.5 million accounts in Vietnam were exposed in data leaks. Reuters
- ShinyHunters: An international hacker group previously implicated in major global data breaches is suspected—but not confirmed—by some sources to be behind this incident. Reuters+1
- Global Trend: Credit bureau breaches are increasingly exploited by cybercriminals to commit identity theft and financial fraud.
Conclusion
Vietnam’s breach of the National Credit Information Center exemplifies growing global challenges in protecting centralized financial data. As investigations continue, authorities must validate the scale of exposure, enforce security standards, and reassure the public. Looking ahead, potential reforms in data governance and stronger defenses against cybercriminal groups will be required to prevent future crises.
🇲🇦 King Mohammed VI’s Speech Sparks Heated Debate in Parliament — “جيل زد يُجيب”
Manufacturing Software at Risk from CVE-2025-5086 Exploit
Spyware Surge: Apple Sends Fourth Security Alert to French Users
Ransomware Attack Disrupts Change Healthcare Service
Zimbabwe’s Drought Crisis: A Nation on the Brink
Fiorentina Bolsters Squad with Moroccan Star Richardson
U.S. Deploys B-52 Bombers to Middle East in Major Show of Force
