corpus.blog
41554 blogs · [ { "id": "01a0b68a-1f9a-7243-aa5e-72986d56894b", "title": "Detecting (Evil) Dylibs", "url": "https://objective-see.org/blog/blog_0x89.html", "published_at": "2026-08-23T00:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-72986d5eb9be", "title": "Catching macOS Stealers in the Wild", "url": "https://objective-see.org/blog/blog_0x88.html", "published_at": "2026-04-01T00:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-72986db646e0", "title": "No Paste for You!", "url": "https://objective-see.org/blog/blog_0x87.html", "published_at": "2026-03-31T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-72986e668f4f", "title": "Building a Firewall ...via Endpoint Security!?", "url": "https://objective-see.org/blog/blog_0x86.html", "published_at": "2026-03-27T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-72986f297305", "title": "ClickFix: Stopped at ⌘+V", "url": "https://objective-see.org/blog/blog_0x85.html", "published_at": "2026-02-15T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-72986f3c367a", "title": "The Mac Malware of 2025", "url": "https://objective-see.org/blog/blog_0x84.html", "published_at": "2026-01-01T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-72986f746995", "title": "A Remote Pre-Authentication Overflow in LLDB's debugserver", "url": "https://objective-see.org/blog/blog_0x83.html", "published_at": "2025-12-08T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-7298705d0b20", "title": "Restoring Reflective Code Loading on macOS (Part II)", "url": "https://objective-see.org/blog/blog_0x82.html", "published_at": "2025-11-24T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-729870d3c8cf", "title": "[0day] From Spotlight to Apple Intelligence", "url": "https://objective-see.org/blog/blog_0x81.html", "published_at": "2025-09-15T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-7298711a15f9", "title": "TCCing is Believing: Apple finally adds TCC events to Endpoint Security!", "url": "https://objective-see.org/blog/blog_0x7F.html", "published_at": "2025-03-27T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-729872046c12", "title": "Leaking Passwords (and more!) on macOS", "url": "https://objective-see.org/blog/blog_0x7E.html", "published_at": "2025-03-20T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-729872444a82", "title": "The Mac Malware of 2024", "url": "https://objective-see.org/blog/blog_0x7D.html", "published_at": "2025-01-01T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-729872d1895f", "title": "Restoring Reflective Code Loading on macOS", "url": "https://objective-see.org/blog/blog_0x7C.html", "published_at": "2024-12-16T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-729873753884", "title": "The Hidden Treasures of Crash Reports", "url": "https://objective-see.org/blog/blog_0x7B.html", "published_at": "2024-08-13T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-72987396bb64", "title": "This Meeting Should Have Been an Email", "url": "https://objective-see.org/blog/blog_0x7A.html", "published_at": "2024-06-15T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-72987493d3d0", "title": "Apple Gets an 'F' for Slicing Apples", "url": "https://objective-see.org/blog/blog_0x80.html", "published_at": "2024-02-22T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-7298753189ce", "title": "Why Join The Navy If You Can Be A Pirate?", "url": "https://objective-see.org/blog/blog_0x79.html", "published_at": "2024-01-15T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-729875506309", "title": "Analyzing DPRK's SpectralBlur", "url": "https://objective-see.org/blog/blog_0x78.html", "published_at": "2024-01-04T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-729875c8a750", "title": "The Mac Malware of 2023", "url": "https://objective-see.org/blog/blog_0x77.html", "published_at": "2024-01-01T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-729875db5731", "title": "It's Turtles All The Way Down", "url": "https://objective-see.org/blog/blog_0x76.html", "published_at": "2023-11-30T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-729876c19e65", "title": "The LockBit ransomware (kinda) comes for macOS", "url": "https://objective-see.org/blog/blog_0x75.html", "published_at": "2023-04-16T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-729877af9e11", "title": "Ironing out (the macOS) details of a Smooth Operator (Part II)", "url": "https://objective-see.org/blog/blog_0x74.html", "published_at": "2023-04-01T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-729877c485dd", "title": "Ironing out (the macOS) details of a Smooth Operator (Part I)", "url": "https://objective-see.org/blog/blog_0x73.html", "published_at": "2023-03-29T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-729878bb8146", "title": "Where there is love, there is ...malware?", "url": "https://objective-see.org/blog/blog_0x72.html", "published_at": "2023-02-14T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-729879b8ced3", "title": "The Mac Malware of 2022", "url": "https://objective-see.org/blog/blog_0x71.html", "published_at": "2023-01-01T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-72987ab80262", "title": "How Shlayer Hides its Configuration", "url": "https://objective-see.org/blog/blog_0x70.html", "published_at": "2022-12-27T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-72987b422423", "title": "SeaFlower 藏海花", "url": "https://objective-see.org/blog/blog_0x6F.html", "published_at": "2022-06-13T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-72987b543b66", "title": "From The DPRK With Love", "url": "https://objective-see.org/blog/blog_0x6E.html", "published_at": "2022-05-09T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-72987b805599", "title": "Analyzing OSX.DazzleSpy", "url": "https://objective-see.org/blog/blog_0x6D.html", "published_at": "2022-01-25T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-72987bc75938", "title": "SysJoker, the first (macOS) malware of 2022!", "url": "https://objective-see.org/blog/blog_0x6C.html", "published_at": "2022-01-11T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-72987cad188c", "title": "The Mac Malware of 2021", "url": "https://objective-see.org/blog/blog_0x6B.html", "published_at": "2022-01-01T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-72987d1c5039", "title": "Where's the Interpreter!?", "url": "https://objective-see.org/blog/blog_0x6A.html", "published_at": "2021-12-22T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-72987d2ed852", "title": "OSX.CDDS (MacMa): A Sophisticated Watering Hole Campaign Drops A New macOS Implant!", "url": "https://objective-see.org/blog/blog_0x69.html", "published_at": "2021-11-11T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-72987ddf9297", "title": "Made In America: Green Lambert for OS X", "url": "https://objective-see.org/blog/blog_0x68.html", "published_at": "2021-10-01T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-72987ec2086b", "title": "Analysis of CVE-2021-30860", "url": "https://objective-see.org/blog/blog_0x67.html", "published_at": "2021-09-16T05:00:00+00:00" }, { "id": "01a0b68a-1f9a-7243-aa5e-72987f532782", "title": "Made in China: OSX.ZuRu", "url": "https://objective-see.org/blog/blog_0x66.html", "published_at": "2021-09-14T05:00:00+00:00" }, { "id": "01a0b68a-1f9b-73db-8de7-6f002885b3b7", "title": "OSX.Hydromac", "url": "https://objective-see.org/blog/blog_0x65.html", "published_at": "2021-06-04T05:00:00+00:00" }, { "id": "01a0b68a-1f9b-73db-8de7-6f0028be4cfb", "title": "All Your Macs Are Belong To Us", "url": "https://objective-see.org/blog/blog_0x64.html", "published_at": "2021-04-26T05:00:00+00:00" }, { "id": "01a0b68a-1f9b-73db-8de7-6f0028ce32f4", "title": "Creating Shield", "url": "https://objective-see.org/blog/blog_0x63.html", "published_at": "2021-03-03T05:00:00+00:00" }, { "id": "01a0b68a-1f9b-73db-8de7-6f00291a1636", "title": "Arm'd & Dangerous", "url": "https://objective-see.org/blog/blog_0x62.html", "published_at": "2021-02-14T05:00:00+00:00" }, { "id": "01a0b68a-1f9b-73db-8de7-6f00298e29ab", "title": "Discharging ElectroRAT", "url": "https://objective-see.org/blog/blog_0x61.html", "published_at": "2021-01-05T05:00:00+00:00" }, { "id": "01a0b68a-1f9b-73db-8de7-6f002a621cfc", "title": "The Mac Malware of 2020", "url": "https://objective-see.org/blog/blog_0x5F.html", "published_at": "2021-01-01T05:00:00+00:00" }, { "id": "01a0b68a-1f9b-73db-8de7-6f002aaad63b", "title": "Detecting SSH Activity via Process Monitoring", "url": "https://objective-see.org/blog/blog_0x5D.html", "published_at": "2020-12-10T05:00:00+00:00" }, { "id": "01a0b68a-1f9b-73db-8de7-6f002ab7c243", "title": "Adventures in Anti-Gravity (Part II)", "url": "https://objective-see.org/blog/blog_0x5C.html", "published_at": "2020-11-27T05:00:00+00:00" }, { "id": "01a0b68a-1f9b-73db-8de7-6f002ac798d9", "title": "Adventures in Anti-Gravity (Part I)", "url": "https://objective-see.org/blog/blog_0x5B.html", "published_at": "2020-11-03T05:00:00+00:00" }, { "id": "01a0b68a-1f9b-73db-8de7-6f002bb1489c", "title": "Property List Parsing Bug(s)", "url": "https://objective-see.org/blog/blog_0x5A.html", "published_at": "2020-10-21T05:00:00+00:00" }, { "id": "01a0b68a-1f9b-73db-8de7-6f002c7b679a", "title": "FinFisher Filleted", "url": "https://objective-see.org/blog/blog_0x4F.html", "published_at": "2020-09-26T05:00:00+00:00" }, { "id": "01a0b68a-1f9b-73db-8de7-6f002d265d58", "title": "Apple Approved Malware", "url": "https://objective-see.org/blog/blog_0x4E.html", "published_at": "2020-08-30T05:00:00+00:00" }, { "id": "01a0b68a-1f9b-73db-8de7-6f002d82161a", "title": "Office Drama on macOS", "url": "https://objective-see.org/blog/blog_0x4B.html", "published_at": "2020-08-04T05:00:00+00:00" }, { "id": "01a0b68a-1f9b-73db-8de7-6f002da0b28e", "title": "CVE-2020–9854: \"Unauthd\"", "url": "https://objective-see.org/blog/blog_0x4D.html", "published_at": "2020-08-01T05:00:00+00:00" }, { "id": "01a0b68a-1f9b-73db-8de7-6f002e5f3ee3", "title": "CVE-2020–9934: Bypassing TCC for Unauthorized Access", "url": "https://objective-see.org/blog/blog_0x4C.html", "published_at": "2020-07-28T05:00:00+00:00" }, { "id": "01a0b68a-1f9b-73db-8de7-6f002e5fab30", "title": "Low-Level Process Hunting on macOS", "url": "https://objective-see.org/blog/blog_0x4A.html", "published_at": "2020-07-19T05:00:00+00:00" }, { "id": "01a0b68a-1f9b-73db-8de7-6f002f0db4e3", "title": "OSX.EvilQuest Uncovered (part two)", "url": "https://objective-see.org/blog/blog_0x60.html", "published_at": "2020-07-03T05:00:00+00:00" }, { "id": "01a0b68a-1f9b-73db-8de7-6f002f5c86da", "title": "OSX.EvilQuest Uncovered (part one)", "url": "https://objective-see.org/blog/blog_0x59.html", "published_at": "2020-06-29T05:00:00+00:00" }, { "id": "01a0b68a-1f9b-73db-8de7-6f002fc2446a", "title": "Tiny SHell Under the Microscope", "url": "https://objective-see.org/blog/blog_0x58.html", "published_at": "2020-06-01T05:00:00+00:00" }, { "id": "01a0b68a-1f9b-73db-8de7-6f00304661ad", "title": "The Dacls RAT ...now on macOS!", "url": "https://objective-see.org/blog/blog_0x57.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f0030d1848a", "title": "The 'S' in Zoom, Stands for Security", "url": "https://objective-see.org/blog/blog_0x56.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f003162d87e", "title": "Sniffing Authentication References on macOS", "url": "https://objective-see.org/blog/blog_0x55.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f0031b6251c", "title": "Weaponizing a Lazarus Group Implant", "url": "https://objective-see.org/blog/blog_0x54.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f003224e4b2", "title": "The Mac Malware of 2019", "url": "https://objective-see.org/blog/blog_0x53.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f0032909697", "title": "Mass Surveillance, is an (un)Complicated Business", "url": "https://objective-see.org/blog/blog_0x52.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f0032c4d9cc", "title": "Lazarus Group Goes 'Fileless'", "url": "https://objective-see.org/blog/blog_0x51.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f00336cb0aa", "title": "[0day] Abusing XLM Macros in SYLK Files", "url": "https://objective-see.org/blog/blog_0x50.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f00338d17e3", "title": "Pass the AppleJeus", "url": "https://objective-see.org/blog/blog_0x49.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f003392a5c5", "title": "Writing a File Monitor with Apple's Endpoint Security Framework", "url": "https://objective-see.org/blog/blog_0x48.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f0033cbbdd2", "title": "Writing a Process Monitor with Apple's Endpoint Security Framework", "url": "https://objective-see.org/blog/blog_0x47.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f0033ed3763", "title": "Getting Root with Benign AppStore Apps", "url": "https://objective-see.org/blog/blog_0x46.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f00346b7b43", "title": "Burned by Fire(fox) (Part III)", "url": "https://objective-see.org/blog/blog_0x45.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f0034f1e628", "title": "Burned by Fire(fox) (Part II)", "url": "https://objective-see.org/blog/blog_0x44.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f003536120a", "title": "Burned by Fire(fox) (Part I)", "url": "https://objective-see.org/blog/blog_0x43.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f0035f3fa0c", "title": "\"Objective by the Sea\" v2.0", "url": "https://objective-see.org/blog/blog_0x42.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f00363631a7", "title": "Rootpipe Reborn (Part II)", "url": "https://objective-see.org/blog/blog_0x41.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f0036c4d23a", "title": "Rootpipe Reborn (Part I)", "url": "https://objective-see.org/blog/blog_0x40.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f0037804731", "title": "Mac Adware, à la Python", "url": "https://objective-see.org/blog/blog_0x3F.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f00384020d5", "title": "Death by vmmap", "url": "https://objective-see.org/blog/blog_0x3E.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f0038427125", "title": "Middle East Cyber-Espionage (part two)", "url": "https://objective-see.org/blog/blog_0x3D.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f0038441264", "title": "The Mac Malware of 2018", "url": "https://objective-see.org/blog/blog_0x3C.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f0038c5427a", "title": "Middle East Cyber-Espionage", "url": "https://objective-see.org/blog/blog_0x3B.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f0039bc5074", "title": "Word to Your Mac", "url": "https://objective-see.org/blog/blog_0x3A.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f003a9d5c58", "title": "[0day] Mojave's Sandbox is Leaky", "url": "https://objective-see.org/blog/blog_0x39.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f003aabdf52", "title": "A Deceitful 'Doctor' in the Mac App Store", "url": "https://objective-see.org/blog/blog_0x37.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f003b789428", "title": "Remote Mac Exploitation Via Custom URL Schemes", "url": "https://objective-see.org/blog/blog_0x38.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f003c20c4ca", "title": "[0day] Synthetic Reality", "url": "https://objective-see.org/blog/blog_0x36.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f003c9f633e", "title": "Escaping the Microsoft Office Sandbox", "url": "https://objective-see.org/blog/blog_0x35.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f003d1a1aa9", "title": "A Remote iOS Bug", "url": "https://objective-see.org/blog/blog_0x34.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f003dd1412b", "title": "[0day] Bypassing SIP via Sandboxing", "url": "https://objective-see.org/blog/blog_0x33.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f003e6025ad", "title": "Block Blocking Login Items", "url": "https://objective-see.org/blog/blog_0x31.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f003ed043b5", "title": "OSX.Dummy", "url": "https://objective-see.org/blog/blog_0x32.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f003ee9af44", "title": "Cache Me Outside", "url": "https://objective-see.org/blog/blog_0x30.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f003f08d9ec", "title": "Breaking macOS Mojave (Beta)", "url": "https://objective-see.org/blog/blog_0x2F.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f003fa01e67", "title": "When Disappearing Messages Don't Disappear", "url": "https://objective-see.org/blog/blog_0x2E.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f0040710a87", "title": "An Insecurity in Apple's Security Framework?", "url": "https://objective-see.org/blog/blog_0x2D.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f004150e1aa", "title": "Who Moved My Pixels?!", "url": "https://objective-see.org/blog/blog_0x2C.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f00422d866a", "title": "A Surreptitious Cryptocurrency Miner in the Mac App Store?", "url": "https://objective-see.org/blog/blog_0x2B.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f0042e57f48", "title": "Tearing Apart the Undetected (OSX)Coldroot RAT", "url": "https://objective-see.org/blog/blog_0x2A.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f00430833b3", "title": "Analyzing OSX/CreativeUpdater", "url": "https://objective-see.org/blog/blog_0x29.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f0043101987", "title": "Analyzing CrossRAT", "url": "https://objective-see.org/blog/blog_0x28.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f00432ce681", "title": "An Unpatched Kernel Bug", "url": "https://objective-see.org/blog/blog_0x27.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f00440b7e8b", "title": "Ay MaMi - Analyzing a New macOS DNS Hijacker", "url": "https://objective-see.org/blog/blog_0x26.html", "published_at": null }, { "id": "01a0b68a-1f9b-73db-8de7-6f0044edfeca", "title": "All Your Docs Are Belong To Us", "url": "https://objective-see.org/blog/blog_0x22.html", "published_at": null } ] posts Claim your blog
Back to objective-see.org
Blog · corpus.blog/blogs/objective-see.org/posts

objective-see.org

objective-see.org

2026

Detecting (Evil) Dylibsoriginal ↗
23 Aug 2026
Catching macOS Stealers in the Wildoriginal ↗
1 Apr 2026
No Paste for You!original ↗
31 Mar 2026
Building a Firewall ...via Endpoint Security!?original ↗
27 Mar 2026
ClickFix: Stopped at ⌘+Voriginal ↗
15 Feb 2026
The Mac Malware of 2025original ↗
1 Jan 2026

2025

A Remote Pre-Authentication Overflow in LLDB's debugserveroriginal ↗
8 Dec 2025
Restoring Reflective Code Loading on macOS (Part II)original ↗
24 Nov 2025
[0day] From Spotlight to Apple Intelligenceoriginal ↗
15 Sept 2025
TCCing is Believing: Apple finally adds TCC events to Endpoint Security!original ↗
27 Mar 2025
Leaking Passwords (and more!) on macOSoriginal ↗
20 Mar 2025
The Mac Malware of 2024original ↗
1 Jan 2025

2024

Restoring Reflective Code Loading on macOSoriginal ↗
16 Dec 2024
The Hidden Treasures of Crash Reportsoriginal ↗
13 Aug 2024
This Meeting Should Have Been an Emailoriginal ↗
15 Jun 2024
Apple Gets an 'F' for Slicing Applesoriginal ↗
22 Feb 2024
Why Join The Navy If You Can Be A Pirate?original ↗
15 Jan 2024
Analyzing DPRK's SpectralBluroriginal ↗
4 Jan 2024
The Mac Malware of 2023original ↗
1 Jan 2024

2023

It's Turtles All The Way Downoriginal ↗
30 Nov 2023
The LockBit ransomware (kinda) comes for macOSoriginal ↗
16 Apr 2023
Ironing out (the macOS) details of a Smooth Operator (Part II)original ↗
1 Apr 2023
Ironing out (the macOS) details of a Smooth Operator (Part I)original ↗
29 Mar 2023
Where there is love, there is ...malware?original ↗
14 Feb 2023
The Mac Malware of 2022original ↗
1 Jan 2023

2022

How Shlayer Hides its Configurationoriginal ↗
27 Dec 2022
SeaFlower 藏海花original ↗
13 Jun 2022
From The DPRK With Loveoriginal ↗
9 May 2022
Analyzing OSX.DazzleSpyoriginal ↗
25 Jan 2022
SysJoker, the first (macOS) malware of 2022!original ↗
11 Jan 2022
The Mac Malware of 2021original ↗
1 Jan 2022

2021

Where's the Interpreter!?original ↗
22 Dec 2021
OSX.CDDS (MacMa): A Sophisticated Watering Hole Campaign Drops A New macOS Implant!original ↗
11 Nov 2021
Made In America: Green Lambert for OS Xoriginal ↗
1 Oct 2021
Analysis of CVE-2021-30860original ↗
16 Sept 2021
Made in China: OSX.ZuRuoriginal ↗
14 Sept 2021
OSX.Hydromacoriginal ↗
4 Jun 2021
All Your Macs Are Belong To Usoriginal ↗
26 Apr 2021
Creating Shieldoriginal ↗
3 Mar 2021
Arm'd & Dangerousoriginal ↗
14 Feb 2021
Discharging ElectroRAToriginal ↗
5 Jan 2021
The Mac Malware of 2020original ↗
1 Jan 2021

2020

Detecting SSH Activity via Process Monitoringoriginal ↗
10 Dec 2020
Adventures in Anti-Gravity (Part II)original ↗
27 Nov 2020
Adventures in Anti-Gravity (Part I)original ↗
3 Nov 2020
Property List Parsing Bug(s)original ↗
21 Oct 2020
FinFisher Filletedoriginal ↗
26 Sept 2020
Apple Approved Malwareoriginal ↗
30 Aug 2020
Office Drama on macOSoriginal ↗
4 Aug 2020
CVE-2020–9854: "Unauthd"original ↗
1 Aug 2020
CVE-2020–9934: Bypassing TCC for Unauthorized Accessoriginal ↗
28 Jul 2020
Low-Level Process Hunting on macOSoriginal ↗
19 Jul 2020
OSX.EvilQuest Uncovered (part two)original ↗
3 Jul 2020
OSX.EvilQuest Uncovered (part one)original ↗
29 Jun 2020
Tiny SHell Under the Microscopeoriginal ↗
1 Jun 2020

Undated

The Dacls RAT ...now on macOS!original ↗
—
The 'S' in Zoom, Stands for Securityoriginal ↗
—
Sniffing Authentication References on macOSoriginal ↗
—
Weaponizing a Lazarus Group Implantoriginal ↗
—
The Mac Malware of 2019original ↗
—
Mass Surveillance, is an (un)Complicated Businessoriginal ↗
—
Lazarus Group Goes 'Fileless'original ↗
—
[0day] Abusing XLM Macros in SYLK Filesoriginal ↗
—
Pass the AppleJeusoriginal ↗
—
Writing a File Monitor with Apple's Endpoint Security Frameworkoriginal ↗
—
Writing a Process Monitor with Apple's Endpoint Security Frameworkoriginal ↗
—
Getting Root with Benign AppStore Appsoriginal ↗
—
Burned by Fire(fox) (Part III)original ↗
—
Burned by Fire(fox) (Part II)original ↗
—
Burned by Fire(fox) (Part I)original ↗
—
"Objective by the Sea" v2.0original ↗
—
Rootpipe Reborn (Part II)original ↗
—
Rootpipe Reborn (Part I)original ↗
—
Mac Adware, à la Pythonoriginal ↗
—
Death by vmmaporiginal ↗
—
Middle East Cyber-Espionage (part two)original ↗
—
The Mac Malware of 2018original ↗
—
Middle East Cyber-Espionageoriginal ↗
—
Word to Your Macoriginal ↗
—
[0day] Mojave's Sandbox is Leakyoriginal ↗
—
A Deceitful 'Doctor' in the Mac App Storeoriginal ↗
—
Remote Mac Exploitation Via Custom URL Schemesoriginal ↗
—
[0day] Synthetic Realityoriginal ↗
—
Escaping the Microsoft Office Sandboxoriginal ↗
—
A Remote iOS Bugoriginal ↗
—
[0day] Bypassing SIP via Sandboxingoriginal ↗
—
Block Blocking Login Itemsoriginal ↗
—
OSX.Dummyoriginal ↗
—
Cache Me Outsideoriginal ↗
—
Breaking macOS Mojave (Beta)original ↗
—
When Disappearing Messages Don't Disappearoriginal ↗
—
An Insecurity in Apple's Security Framework?original ↗
—
Who Moved My Pixels?!original ↗
—
A Surreptitious Cryptocurrency Miner in the Mac App Store?original ↗
—
Tearing Apart the Undetected (OSX)Coldroot RAToriginal ↗
—
Analyzing OSX/CreativeUpdateroriginal ↗
—
Analyzing CrossRAToriginal ↗
—
An Unpatched Kernel Bugoriginal ↗
—
Ay MaMi - Analyzing a New macOS DNS Hijackeroriginal ↗
—
All Your Docs Are Belong To Usoriginal ↗
—
Next