Targeted Attack Designed to Infect Both Macs and PCs.
UPDATE (25th June): Guy Kawasaki has stated that his Twitter account was not compromised, the malicious tweet came from a feed that Guy's account is subscribed to automatically post. The feed comes from NowPublic, a user generated news feed.
Context & Ripple Effects
The attack lands in a stretch when Mac-targeted incidents have stopped being rare: hackers hit MacRumors' keynote coverage in January 2009, and coverage as far back as December 2007 framed Apple's rising popularity as what lures hackers to the platform in the first place.
What makes this one different is the delivery channel rather than the payload: the malicious tweets did not come from a compromised account — Guy Kawasaki has denied that his Twitter account was breached — but from a NowPublic user-generated news feed his account auto-posts from. The trusted automation layer between a publisher and its followers became the infection vector, and the payload was built to hit Macs and PCs alike.
First-order effects
- Anyone following accounts that auto-post from NowPublic feeds — Kawasaki's followers most visibly — was exposed to malicious tweets without any account compromise having occurred, making the breach invisible to the account owner until after the fact.
- Kawasaki faces a reputation problem despite a clean bill of health for his credentials: the denial clarifies that his account was not hacked, but it also confirms that his publishing pipeline pushed attacker-controlled content to his audience.
Second-order effects
- Auto-posting integrations between social accounts and third-party content sources become a trust liability that users and publishers must audit — whoever vouches for a feed inherits responsibility for everything that feed publishes.
- A single campaign targeting both platforms undercuts the residual assumption that Macs sit outside mainstream malware economics, pressuring security vendors to treat cross-platform threats as the default case rather than the exception.
Third-order effects
- If attacks keep routing through trusted distribution channels instead of exploiting endpoints directly, defense shifts upstream from operating systems toward the provenance of automated content feeds — a structural question about who verifies what machines post on people's behalf.
- The pattern points toward platform-agnostic malware as Apple's installed base grows, eroding the historical asymmetry that kept Mac-focused attackers marginal.
The trend: As Mac market share rises and social accounts delegate posting to automated feeds, attackers are moving from platform-specific exploits toward trusted distribution channels, making cross-platform payloads the emerging norm.