Google researchers found a watering hole attack in August exploiting a macOS zero-day and targeting Hong Kong pro-democracy sites; Apple patched on September 23
“The nature of the activity and targeting is consistent with a government backed actor,” the Google researchers say. Source: The Keyword .
Apple’s September 23 update closes the identified macOS vulnerability for users who install it, ending the reported exploit path on patched devices.
Visitors to the targeted Hong Kong pro-democracy sites were exposed through a compromised-web destination rather than an individually delivered lure, while Google’s assessment ties the activity to a likely government-backed operation.
Second-order effects
Operators of the targeted sites need to treat site integrity as part of visitor security: an operating-system patch removes the device exploit but does not by itself address a watering-hole compromise.
For Apple and Google, the case makes patch deployment and campaign investigation complementary tasks, because the exploit’s political targeting determines who may need remediation beyond ordinary software updating.
Third-order effects
The related coverage points to a durable security model in which government-linked operations exploit gaps before patches are widely deployed, leaving platform vendors and threat-research teams to combine vulnerability response with targeted-attack tracking.
If this pattern persists, high-risk civil-society communities will remain a distinct protection problem for consumer platforms: securing endpoints alone does not eliminate risk created by trusted websites being used as attack channels.
The trend: Government-linked intrusion campaigns are pairing zero-day exploitation with narrowly selected web audiences, making threat intelligence and rapid patch adoption increasingly interdependent.
.@ShaneHuntley told me that the zero-day Google found was “identical” to the one @PanguTeam presented at zer0con21 in April 2021 and Mobile Security Conference (MOSEC) in July 2021. Would really like to know what happened here...
@shanehuntley
Shane Huntley on x
“The recent attacks specifically focused on compromising Hong Kong websites “for a media outlet and a prominent pro-democracy labor and political group,” according to the TAG report. ” https://twitter.com/...
@royalhansen
Royal Hansen on x
Google researchers caught hackers targeting users in Hong Kong exploiting what were at the time unknown vulnerabilities in Apple's Mac operating system https://www.vice.com/...
@objective_see
Objective-See on x
Google uncovered a sophisticated attack that leveraged both iOS & macOS exploits (n-/0-days) to infect Apple users! 👀 Interested in a triage of the macOS implant (named OSX.CDDS), including: ▫️ Installation ▫️ Persistence ▫️ Capabilities 📝 Have a read: https://objective-see.com/.…
@motherboard
@motherboard on x
According to Google researchers, the attacks have the hallmarks of government-backed hackers. https://www.vice.com/...
@maddiestone
Maddie Stone on x
And check out the great write-up which goes into details of CVE-2021-30869 by @eryeh! #itw0days https://blog.google/... https://twitter.com/...
@vy_tweetss
Vy N. on x
By the way, for those pledging to not use vendors who utilize these programs, FTI Consulting / Acuity used such software, at least when I worked for them in 2020. I couldn't so much as take a sip from my water bottle without the program telling me I'm breaking the rules. https://…
@gadgetlab
@gadgetlab on x
Visitors to pro-democracy and media sites in the region were infected with malware that could download files, steal data, and more. https://www.wired.com/...
@charlesmok
@charlesmok on x
“The activity and targeting is consistent with a govt-backed actor.” Hackers Targeted Apple Devices in Hong Kong for Widespread Attack | WIRED VIsitors to pro-democracy and media sites were infected with malware that could download files, steal data... https://www.wired.com/...
@ibjiyongi
@ibjiyongi on x
‘He added only that “the activity and targeting is consistent with a government-backed actor.”’ https://www.wired.com/...
@wang_maya
@wang_maya on x
!!! Chinese govt has hacked #HongKong people's Apple devices *en masse* using “watering hole” attacks—any devices that visited a Hong Kong-based media and pro-democracy websites are affected. The last such broad-based attack happened to Uyghurs in 2019: https://www.wired.com/...
@lilyhnewman
Lily Hay Newman on x
Google TAG uncovered a watering hole attack in August that was targeting visitors to Hong Kong media and pro-democracy sites https://www.wired.com/...
@snlyngaas
Sean Lyngaas on x
Google researchers expose a “likely state backed” hacking effort that targeted some visitors to news and pro-democracy websites in Hong Kong. https://blog.google/...
@lorenzofb
Lorenzo Franceschi-Bicchierai on x
Before we start a debate about what is a zero-day and what isn't: Google labels this a zero-day because the Chinese researchers disclosed it in MacOS Big Sur, but the hackers used it on MacOS Catalina, where it was not patched. Google's full report: https://blog.google/...
@eryeh
Erye Hernandez on x
Glad to be able to share some additional details on the campaign leveraging the macOS privesc (CVE-2021-30869) to install a new macOS backdoor https://blog.google/...
@shanehuntley
Shane Huntley on x
More technical details from @eryeh and the team on last months exploit and the associated campaign. https://blog.google/... TAG discovered watering hole attacks targeting visitors to Hong Kong websites for a media outlet and a prominent pro-democracy labor and political group. ht…
@josheidelson
Josh Eidelson on x
“The system often failed to recognize her face or mistook the Bantu knots in her hair as unauthorized recording devices, forcing her to log back in sometimes more than 25 times a day.” https://www.washingtonpost.com/ ... @drewharwell
@washingtonpost
@washingtonpost on x
Contract lawyers face a growing invasion of surveillance programs that monitor their work https://www.washingtonpost.com/ ...
@jjvincent
James Vincent on x
“After verifying their identity, the software judges their level of attention or distraction and kicks them out of their work networks if the system thinks they're not focused enough.” —> remote surveillance is coming for us all https://www.washingtonpost.com/ ...
@drewharwell
Drew Harwell on x
A symptom of “pervasive employer attitudes” to “treat employees as commodities”: “A desire to control more of the workplace, just because you can ... and because the cost of all the heavy-handedness comes down on the employee” https://www.washingtonpost.com/ ...
@lorenzofb
Lorenzo Franceschi-Bicchierai on x
New: In August Google caught hackers using an old Mac exploit together with a zero-day that was published by a research group at a Chinese cybersecurity conference in April. The hackers were targeting Hong Kong users. https://www.vice.com/...
@runasand
Runa Sandvik on x
Google provided a thorough overview of the macOS exploit chain. In this post, @patrickwardle looks at the persistent macOS implant that would be installed upon successfully exploited systems. https://objective-see.com/...