Field Glass
What Macintosh threats look like this week
With Innsegall, no one is your enemy · you have no foe.
Chan eil nàmhaid agad.
This is not a panic bulletin. It is a field glass · what we are seeing on the mist road so you can tell shadow from substance.
1. Fake installers are leaving the “coding test” lane
The Contagious Interview campaign used to lean on fake take-home repos. In early September 2026, researchers surfaced 14 trojanized macOS disk images and packages impersonating familiar apps · Sketch, Bartender, The Unarchiver, and others.
What to do: Do not install Mac software from a recruiter DM or a link that is not the vendor’s official site. If you already installed something from that thread, run Innsegall’s I clicked a suspicious link flow. If you entered passwords after the install, rotate credentials from a clean device.
2. Screen Sharing: patched, but still exploited
CVE-2026-65400 is an authentication bypass in macOS Screen Sharing. Apple fixed it in macOS 26.6.1, 15.7.9, and 14.8.9. Real compromises were reported on Macs with TCP 5900 exposed to the internet.
What to do: Patch. Turn off Screen Sharing unless you need it. Never expose port 5900 directly · use VPN or SSH tunneling for remote access.
3. Rust developers: a short supply-chain window
On August 20, 2026, malicious versions of widely used Rust crates appeared on crates.io for roughly two hours. On macOS the payload is Rustbot · a RAT that profiles the host and installs a launch agent.
What to do: If your team compiled affected projects in that window, treat the Mac as worth a deliberate audit. Innsegall’s Is my project safe? flow is built for that check.
Evergreen: the Terminal paste trap
ClickFix-style lures remain common: a fake page that tells you to paste a command into Terminal. Legitimate software never requires that.
If you pasted: stop · run I clicked a suspicious link on Innsegall · if you typed your Mac password for that prompt, escalate and rotate from a device you trust.
Light, not war
The security industry trained us to live at permanent DEFCON. Innsegall’s job is the opposite: name what was checked, name what is gone, mark the path clear.
Send the scout when the fog rolls in. Bring your clan if the horn sounds.