# Best of thehackernews.com on Kiwi News

Page: https://news.kiwistand.com/source/thehackernews.com

8 stories from thehackernews.com have been shared on Kiwi News since 6 September 2023, with 26 upvotes and 3 comments in total. The latest was shared on 12 March 2026. They are listed below, most upvoted first.

Summaries are AI summaries of the linked article.

## 1. Apple Patches Zero-Day in iOS, iPadOS, and macOS Exploited in Targeted Attacks

- Kiwi News: https://news.kiwistand.com/stories/Apple-Patches-Zero-Day-in-iOS-iPadOS-and-macOS-Exploited-in-Targeted-Attacks?index=0x68a962a96fa50bceada63f23b64b3e15ee3f6ab7777e2998f9e209a783cde7290b28f559
- Source: https://thehackernews.com/2025/08/apple-patches-cve-2025-43300-zero-day.html?m=1
- Shared 23 August 2025, 13 upvotes, 0 comments

Apple has released security updates for iOS, iPadOS, and macOS to fix a zero-day vulnerability that it says has been actively exploited in the wild. The flaw, tracked as CVE-2025-43300 with a CVSS score of 8.8, is an out-of-bounds write in the ImageIO framework that can cause memory corruption when a malicious image is processed. Apple said it was aware of a report that the issue may have been used in an extremely sophisticated attack against specific targeted individuals, and that it was fixed with improved bounds checking. With this update, Apple has fixed seven zero-days exploited in real-world attacks so far this year.

## 2. Chinese Android Phones Shipped with Fake Apps Targeting Crypto Users

- Kiwi News: https://news.kiwistand.com/stories/Chinese-Android-Phones-Shipped-with-Fake-Apps-Targeting-Crypto-Users?index=0x680031ea90d5d34c36b8e2ad1a4d8d11041def6ddb8fea9b1e155ec03351783170903db6
- Source: https://thehackernews.com/2025/04/chinese-android-phones-shipped-with.html
- Shared 16 April 2025, 4 upvotes, 2 comments

Doctor Web reports that cheap Android phones from Chinese manufacturers were found with trojanized WhatsApp and Telegram apps pre-installed, containing cryptocurrency clipper functionality as part of a campaign active since June 2024. The malware, dubbed Shibai, is built with the open-source LSPatch project and reportedly modifies about 40 applications, including messengers and QR code scanners, to swap Ethereum and Tron wallet addresses in chats. The malware also uploads WhatsApp messages and images from device folders to the attacker's server, where the images are scanned for wallet recovery phrases. Doctor Web says the attackers have received more than $1.6 million over the last two years across nearly two dozen wallets.

## 3. Trick Perplexity's Comet AI Browser Into Phishing Scam in Under Four Minutes

- Kiwi News: https://news.kiwistand.com/stories/Trick-Perplexitys-Comet-AI-Browser-Into-Phishing-Scam-in-Under-Four-Minutes?index=0x69b34723e60bfc5a17b5ecbfc7191888b60cbe229f4fc6595a3d8fd2cbc5b17fa9d7d5a1
- Source: https://thehackernews.com/2026/03/researchers-trick-perplexitys-comet-ai.html
- Shared 12 March 2026, 2 upvotes, 0 comments

Guardio reports that it tricked Perplexity's Comet AI browser into falling for a phishing scam in under four minutes by exploiting the agent's tendency to narrate its reasoning. Guardio said it intercepted traffic between the browser and the vendor's AI services and fed it into a Generative Adversarial Network, which iteratively regenerated a phishing page until the browser proceeded to enter credentials on a bogus refund page. Security researcher Shaked Chen said the same approach could work on every user relying on that agent, since the target shifts from the human to the AI. The article also cites separate Trail of Bits and Zenity Labs research on prompt injection flaws in Comet, which Perplexity has addressed, and notes OpenAI's view that such weaknesses are "unlikely to ever" be fully resolved in agentic browsers.

## 4. Anthropic Disrupts AI-Powered Cyberattacks Automating Theft and Extortion

- Kiwi News: https://news.kiwistand.com/stories/Anthropic-Disrupts-AI-Powered-Cyberattacks-Automating-Theft-and-Extortion?index=0x68af5799a46f30874fee58f4ba4f3a8c543b6069fe8e2535cba43d0149d0c499774dbd36
- Source: https://thehackernews.com/2025/08/anthropic-disrupts-ai-powered.html?m=1
- Shared 27 August 2025, 2 upvotes, 0 comments

Anthropic said it disrupted a large-scale theft and extortion operation that used its Claude chatbot, with the activity occurring in July 2025. The unknown threat actor, codenamed GTG-2002, used Claude Code to automate reconnaissance, credential harvesting and network penetration, targeting at least 17 organizations including healthcare, emergency services, government and religious institutions. Rather than encrypting data, the actor threatened to publish stolen information to extort ransoms that sometimes exceeded $500,000. Anthropic said it developed a custom classifier to screen for similar behavior and shared technical indicators with key partners.

## 5. Beware of MalDoc in PDF: A new polyglot attack allowing attackers to evade antiV

- Kiwi News: https://news.kiwistand.com/stories/Beware-of-MalDoc-in-PDF-A-new-polyglot-attack-allowing-attackers-to-evade-antiV?index=0x64f8a3af5c6f4a64693448c391c5ce78cbc3aee6fbb6f7d018cedc9df239d51c4a836a35
- Source: https://thehackernews.com/2023/09/beware-of-maldoc-in-pdf-new-polyglot.html
- Shared 6 September 2023, 2 upvotes, 0 comments

Researchers have described MalDoc in PDF, a polyglot technique that embeds a malicious Word file inside a PDF so it can evade antivirus detection. JPCERT/CC named the method, which was reportedly used in an in-the-wild attack in July 2023. Yuma Masubuchi and Kota Kino explained that the file keeps PDF magic numbers and structure yet opens in Word, where a configured macro runs a VBS script. Security researcher Will Dormann noted that Protected View blocks the macro until the user clicks "Enable Editing."

## 6. Researchers Find 341 Malicious ClawHub Skills Stealing Data from OpenClaw Users

- Kiwi News: https://news.kiwistand.com/stories/Researchers-Find-341-Malicious-ClawHub-Skills-Stealing-Data-from-OpenClaw-Users?index=0x69830642b28b290ca6da3d1c08380c9cd517cba2a09954497b15b7ab0d78200409d1bf28
- Source: https://thehackernews.com/2026/02/researchers-find-341-malicious-clawhub.html
- Shared 4 February 2026, 1 upvote, 1 comment

Koi Security's audit of 2,857 skills on ClawHub found 341 malicious skills across multiple campaigns, exposing OpenClaw users to new supply chain risks. The analysis, conducted with help from an OpenClaw bot named Alex, found that 335 skills use fake prerequisites to install the Atomic Stealer (AMOS) macOS stealer, a activity set Koi codenamed ClawHavoc. Koi researcher Oren Yomtov said the skills' documentation looks professional but includes a "Prerequisites" section that tells users to install something first. The article notes that ClawHub is open by default, and that OpenClaw creator Peter Steinberger has since added a reporting feature that auto-hides skills with more than 3 unique reports.

## 7. Apple Issues Security Updates After Two WebKit Flaws Found Exploited in the Wild

- Kiwi News: https://news.kiwistand.com/stories/Apple-Issues-Security-Updates-After-Two-WebKit-Flaws-Found-Exploited-in-the-Wild?index=0x693e05139a6deaa9ef85c61958ce1caa29b5d9917afe17c6bb396ecd185dfc43bda9ba82
- Source: https://thehackernews.com/2025/12/apple-issues-security-updates-after-two.html
- Shared 14 December 2025, 1 upvote, 0 comments

Apple released security updates on Friday for iOS, iPadOS, macOS, tvOS, watchOS, visionOS and Safari to fix two WebKit flaws, CVE-2025-43529 and CVE-2025-14174, that it said have been exploited in the wild. Apple said the flaws "may have been exploited in an extremely sophisticated attack against specific targeted individuals" on versions of iOS before iOS 26. CVE-2025-14174 is the same flaw Google patched in Chrome on December 10, 2025, an out-of-bounds memory access in its ANGLE library's Metal renderer. Apple credited Apple Security Engineering and Architecture (SEAR) and Google Threat Analysis Group (TAG) with the CVE-2025-14174 discovery and credited TAG with CVE-2025-43529. With these updates, Apple has patched nine zero-day vulnerabilities exploited in the wild in 2025.

## 8. How 'browser-in-the-middle' attacks steal sessions in seconds

- Kiwi News: https://news.kiwistand.com/stories/How-browser-in-the-middle-attacks-steal-sessions-in-seconds?index=0x6838140aea06a4ec7a92c56cc768e8ebdaebd56a0aa59f59b18e07b07a6198ebfed36685
- Source: https://thehackernews.com/2025/05/how-browser-in-middle-attacks-steal.html?m=1
- Shared 29 May 2025, 1 upvote, 0 comments

Browser-in-the-Middle (BitM) attacks have the victim unknowingly use a transparent remote browser controlled by the attacker, letting criminals capture session tokens and bypass multi-factor authentication. University of Salento researchers Franco Tommasi, Christian Catalano, and Ivan Taurino outlined the attack in a paper for the International Journal of Information Security. Citing Google subsidiary Mandiant, the article says that once a session token is stolen, an attacker no longer needs to pass the MFA challenge, and can reach any website in seconds. The article concludes that passwords remain relevant and recommends layered defenses such as short-lived tokens, browser isolation and behavioral monitoring.