DAILY BRIEFING
Realtek SDK exploited for Cling botnet; Apple tightens macOS Full Disk Access for AI
Today's briefing covers Realtek Jungle SDK exploit attempts deploying Cling botnet malware, Apple's tighter macOS controls on AI agent data access, and expanding credential security challenges.
5 stories2 min read
Threat actors continue to leverage legacy vulnerabilities and evolving technology surfaces to gain unauthorized access. A recent spike in attacks targets a known Realtek Jungle SDK vulnerability to drop botnet malware, utilizing ordinary STUN traffic to mask command-and-control operations as legitimate network activity.
At the same time, platform vendor security policies are adjusting to rapid technological shifts. Apple is moving to restrict Full Disk Access implementations on macOS to prevent emerging AI agents and software tools from exposing sensitive user data without explicit oversight.
Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2
Threat actors are attempting to exploit CVE-2021-35394 in the Realtek Jungle SDK to deploy Cling botnet malware, which repurposes STUN traffic for command-and-control operations.
- What to do
- Patch devices using vulnerable Realtek Jungle SDK versions and inspect STUN protocol activity for anomalies.
The Credential Layer Is Expanding Faster Than Security Teams Can See It
Every modern enterprise depends on credentials.
- Why it matters
- The expansion of automated workflows and application infrastructure expands the attack surface faster than security teams can track unmanaged secrets.
Apple Plans Tighter macOS Full Disk Access Controls Over AI Agent Data Access
Apple announced plans to restrict Full Disk Access settings in macOS to address privacy and security risks caused by AI agents over-requesting broad system access.
- Why it matters
- Applications or AI agents granted Full Disk Access can read sensitive system files, messages, mail, and web history without full user awareness.
tenfold CE: Our free Identity Governance tool just got 2 new features
tenfold has added shared content governance and real-time event auditing to its free Community Edition for organizations with under 150 users.
- What to do
- Re-visit the source page directly to verify update details.
Alleged dev of Ploutus ATM malware appears in US court after arrest
The U.S.
Key takeaways
- Exploit attempts targeting Realtek Jungle SDK vulnerability CVE-2021-35394 spiked around September 5, 2026, delivering Cling botnet malware.
- Cling botnet uses standard STUN protocol behavior to disguise its command-and-control channel as routine NAT-traversal traffic.
- Apple is restricting macOS Full Disk Access controls to reduce data exposure risks associated with AI agents and third-party software.