Targeting software developers is one route to a successful supply chain attack. Now threat actors are going after Apple developers through the Xcode IDE.
Posts TaggedmacOS
20 Common Tools & Techniques Used by macOS Threat Actors & Malware
Threat hunting on macOS? These are the tools malware most often leverages, with ITW examples, MITRE behavioral indicators and links to further research.
FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts
We show how to statically reverse run-only AppleScripts for the first time, and in the process reveal new IoCs of a long-running macOS Cryptominer campaign.
APT32 Multi-stage macOS Trojan Innovates on Crimeware Scripting Technique
Vietnamese-linked APT group OceanLotus have innovated and imitated in their latest macOS trojan, while also leaving a mysterious hard-coded calling card.
Resourceful macOS Malware Hides in Named Fork
Threat actors targeting macOS are deploying a new trick to hide payloads and avoid detection thanks to an old technology: the named resource fork.
Breaking EvilQuest | Reversing A Custom macOS Ransomware File Encryption Routine
A new macOS ransomware threat uses a custom file encryption routine not based on public key encryption. Jason Reaves shows how we broke it.
Privilege Escalation | macOS Malware & The Path to Root Part 1
Researchers invest huge amounts of effort to uncover privilege escalations and develop exploits. What can we learn about macOS security from their work?
Detecting macOS.GMERA Malware Through Behavioral Inspection
New malware hits macOS with well-worn techniques. Can behavioral detection prevent attacks that evade legacy AV and built-in Apple security?
macOS Incident Response | Part 3: System Manipulation
How can you detect system manipulations by malware, local or remote attackers on macOS? Find out in the final part of our series on macOS Incident Response.
macOS Incident Response | Part 2: User Data, Activity and Behavior
What can we learn about user activity and behavior on a compromised Mac? Learn about the hidden and obfuscated data stores Apple use on the macOS platform.