Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2026-06-23 ⋅ Sentinel LABS ⋅ Phil Stokes
macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox
Gaslight
2025-04-27 ⋅ SentinelOne ⋅ Phil Stokes
Atomic Stealer | Threat Actor Spawns Second Variant of macOS Malware Sold on Telegram
AMOS
2025-02-03 ⋅ SentinelOne ⋅ Phil Stokes, Tom Hegel
macOS FlexibleFerret | Further Variants of DPRK Malware Family Unearthed
FlexibleFerret FriendlyFerret FrostyFerret
2024-04-02 ⋅ SentinelOne ⋅ Phil Stokes
Session Cookies, Keychains, SSH Keys and More | 7 Kinds of Data Malware Steals from macOS Users
EggShell RAT KeySteal Pureland
2023-11-27 ⋅ SentinelOne ⋅ Phil Stokes
DPRK Crypto Theft | macOS RustBucket Droppers Pivot to Deliver KandyKorn Payloads
HLOADER KANDYKORN RustBucket SUGARLOADER
2023-08-21 ⋅ SentinelOne ⋅ Dinesh Devadoss, Phil Stokes
XLoader's Latest Trick | New macOS Variant Disguised as Signed OfficeNote App
Xloader
2023-07-05 ⋅ SentinelOne ⋅ Phil Stokes
BlueNoroff | How DPRK’s macOS RustBucket Seeks to Evade Analysis and Detection
RustBucket
2022-09-26 ⋅ SentinelOne ⋅ Dinesh Devadoss, Phil Stokes
Lazarus ‘Operation In(ter)ception’ Targets macOS Users Dreaming of Jobs in Crypto
Interception
2022-05-09 ⋅ Dinesh Devadoss, Phil Stokes
From the Front Lines | Unsigned macOS oRAT Malware Gambles For The Win
oRAT
2022-05-09 ⋅ SentinelOne ⋅ Dinesh Devadoss, Phil Stokes
From the Front Lines | Unsigned macOS oRAT Malware Gambles For The Win
2022-03-21 ⋅ SentinelOne ⋅ Phil Stokes
The Art and Science of macOS Malware Hunting with radare2 | Leveraging Xrefs, YARA and Zignatures
AbstractEmu Vigram
2022-02-01 ⋅ SentinelOne ⋅ Phil Stokes
Sneaky Spies and Backdoor RATs | SysJoker and DazzleSpy Malware Target macOS
DazzleSpy SysJoker
2021-11-15 ⋅ SentinelOne ⋅ Phil Stokes
Infect If Needed | A Deeper Dive Into Targeted Backdoor macOS.Macma
CDDS
2021-09-20 ⋅ SentinelOne ⋅ Phil Stokes
Defeating macOS Malware Anti-Analysis Tricks with Radare2
EvilQuest
2021-07-26 ⋅ SentinelOne ⋅ Phil Stokes
Detecting XLoader | A macOS ‘Malware-as-a-Service’ Info Stealer and Keylogger
Xloader
2021-03-18 ⋅ SentinelOne ⋅ Phil Stokes
New macOS malware XcodeSpy Targets Xcode Developers with EggShell Backdoor
2021-01-11 ⋅ Sentinel LABS ⋅ Phil Stokes
FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts
OSAMiner
2020-12-02 ⋅ SentinelOne ⋅ Phil Stokes
APT32 Multi-stage macOS Trojan Innovates on Crimeware Scripting Technique
OceanLotus
2020-11-05 ⋅ SentinelOne ⋅ Phil Stokes
Resourceful macOS Malware Hides in Named Fork
Bundlore
2020-07-27 ⋅ SentinelOne ⋅ Phil Stokes
Four Distinct Families of Lazarus Malware Target Apple’s macOS Platform
AppleJeus Casso Dacls WatchCat
2020-07-08 ⋅ SentinelOne ⋅ Phil Stokes
“EvilQuest” Rolls Ransomware, Spyware & Data Theft Into One
EvilQuest
2020-06-08 ⋅ SentinelOne ⋅ Phil Stokes
A Guide to macOS Threat Hunting and Incident Response
2020-05-15 ⋅ SentinelOne ⋅ Phil Stokes
A Guide to macOS Threat Hunting and Incident Response
2018-09-20 ⋅ SentinelOne ⋅ Phil Stokes
On the Trail of OSX.FairyTale | Adware Playing at Malware
FailyTale