Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: Medium
Victim: Meta Muse users on macOS
Incident: A proof-of-concept vulnerability allows local malware to hijack Meta Muse AI dictation and session tokens.
Impact: Unauthorized access to user files, messages, emails, and device location via hijacked AI permissions.
Attacker: Unidentified threat actors
Analysis: Researcher Patrick Wardle discovered that modifying an undocumented preference allows local malware to redirect AI prompts to an external server. This bypasses macOS’s app sandboxing by leveraging the trusted permissions already granted to Muse. Attackers can subsequently steal session tokens to control the assistant across multiple devices, including iPhones.
Recommendations: Uninstall or quit the Meta Muse app on macOS until a patch is released; Restrict broad permissions granted to AI assistants; Employ endpoint detection tools to monitor for unauthorized modifications to app preferences
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source