Microsoft Warns of macOS Ransomware Surge

• CVE-2026-20700: Memory corruption vulnerability in Apple's Dynamic Link Editor (dyld) allowing arbitrary code execution; affects macOS Tahoe 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, and corresponding iOS/iPadOS/watchOS/tvOS/visionOS versions[3][5] • CVE-2026-20620: Out-of-bounds read vulnerability from insufficient input validation; can cause system termination or kernel memory disclosure; affects macOS Sequoia <15.7.4, macOS Tahoe <26.3, macOS Sonoma <14.8.4[2] • WebKit Zero-Day Exploits: Two zero-day bugs in WebKit engine (Safari and third-party Mac browsers) already exploited in the wild; attackers execute malicious code via crafted web pages[1] • DigitStealer Architecture: JXA-based infostealer targeting 18 cryptocurrency wallets; distributed via fake installers and social engineering prompts for password entry[10] • Infection Chains: Multi-stage attacks combine CVE-2026-20700 with CVE-2025-14174 (ANGLE memory access flaw in Chrome) and CVE-2025-43529 for sophisticated targeted exploitation[3][5] • Distribution Vectors: Fake Google Ads, pirated software installers, WhatsApp chains, and malicious domain registrations mimicking legitimate services[9]

The convergence of actively exploited zero-day vulnerabilities, sophisticated infostealer malware, and evolving phishing infrastructure indicates macOS is transitioning from a lower-risk platform to an increasingly attractive target for financially motivated and state-sponsored threat actors. The doubling of malware detections combined with end-of-life browser support for older macOS versions creates a widening security gap, particularly for users unable to upgrade immediately. Organizations and individuals should expect continued targeting of cryptocurrency wallets and financial credentials through multi-stage attacks that chain multiple vulnerabilities. The use of Python-based cross-platform stealers suggests attackers are developing infrastructure to simultaneously target Windows, Linux, and macOS, indicating a shift toward platform-agnostic malware development strategies.