May 2025 – White Hat Mac

Malicious npm packages infect Cursor AI

Kirill Boychenko revealed, on May 7, findings that showed several malicious npm packages targeting Mac developers. The malware was specifically targeting developers using the Cursor AI code editor, with the purpose of stealing Cursor credentials and modifying the Cursor app.

Mac stealer distributed via fake CAPTCHAs

In a very interesting article on BadByte, it was revealed that a malicious CAPTCHA had been spotted on a legitimate site that had been compromised. The CAPTCHA was designed to trick the user into actions that would infect the machine with Atomic Stealer. Worse, this campaign, dubbed MacReaper, was then tracked to around 2,800 other potentially compromised sites.

Banshee stealer updates

Kaspersky posted a summary of some high-level updates on Banshee back in January. Although it’s a bit light on specific details about behavior, there’s still some very interesting information there.

Reboot!

This blog has languished without a clear purpose ever since I created it. I simply never had time to flesh it out. It’s time for that to change. Expect to see more articles here, starting now!