Weekly Recap: Chrome Zero-Day, UniFi RCE, macOS Stealers, and a VPN Auth Bypass

Key points

• Chrome received an emergency patch for an in-the-wild V8 type-confusion zero-day; check your fleet against the Stable Channel update notes.
• Ubiquiti's UniFi Network Application has an authenticated API path that escalates to remote code execution on the controller host.
• MacOS stealers are spreading through fake AI-tool installers, harvesting Keychain data and crypto wallet files.
• A pre-auth authentication bypass in an unnamed VPN edge appliance exposes a legacy login endpoint that was never deprecated.
• A hijacked npm package shipped a post-install script pulling second-stage payloads from a Cloudflare Worker.

The pattern this week was depressingly familiar. An old tool left unpatched. A package nobody audited. A deprecated feature still answering production traffic. Attackers know this terrain better than most defenders do.

What makes the Chrome bug different from everything else here?

Chrome shipped an emergency update for an in-the-wild zero-day in the V8 JavaScript engine, a type-confusion class of bug that keeps making the browser the most reliable initial-access vector on the desktop. Patch status should be checked against the Stable Channel update notes at https://chromereleases.googleblog.com/. It's the only item this week that required genuine research to find.

How bad is the UniFi exposure?

Ubiquiti's UniFi stack took another hit. The exploit path involves authenticated API abuse that escalates to command execution on the controller host. Many managed service providers run a single controller for dozens of customer sites, so the blast radius is not contained. Treat any internet-exposed UniFi Network Application as compromised until proven otherwise, and pull the controller logs before you pull the patch.

Should you worry about macOS stealers?

The macOS stealer ecosystem keeps maturing. Atomic, Banshee and newer Cthulhu variants are now distributed through cracked-app sites and fake AI-tool installers, with ChatGPT desktop clients remaining a favourite lure. They harvest Keychain entries and crypto wallet files, then exfiltrate over plain HTTPS to commodity command-and-control infrastructure. Gatekeeper bypasses via ad-hoc code signing are doing most of the work. EDR (endpoint detection and response) coverage on Mac endpoints is still the exception, not the rule. We first tracked this distribution pattern in our 15 June report on macOS stealer activity.

What is the VPN authentication bypass?

The VPN flaw of the week is a pre-authentication bypass in an edge appliance that exposes a legacy login endpoint the vendor never deprecated. Network-reachable. Trivially weaponized. Check vendor advisories directly; the patched firmware version matters more than the marketing CVSS score.

What else happened this week?

A widely used npm package was hijacked through a maintainer's compromised account. Lockfile pinning is not optional. Phishing-as-a-service kits added MFA-relay modules as a default feature this quarter, not a premium tier. Number-matching helps; phishing-resistant FIDO2 (the hardware-key standard) helps more. The Sniper Dz takedown we reported on 12 June showed how quickly these kits redeploy after a disruption, and the commodity MFA-relay feature is exactly that kind of adaptation. Ransomware affiliates are also buying initial access keyed specifically to ScreenConnect and AnyDesk instances exposed to the public internet. Inventory your remote-management tooling.

None of this required a novel exploit. The Chrome zero-day is the only thing here that took real research. Everything else was operational hygiene that someone decided could wait. It couldn't. Patch the browser, audit the controllers, kill the deprecated login paths, and get the cracked-app installers off your Macs.