Hacker, security geek, climber, spanner monkey, and occasional builder of rally cars
Australia
Joined March 2009
- Tweets14.7K
- Following764
- Followers768
- Likes329
sysop_host retweeted
The AI prompt collection we’ve introduced here is 🔥
An AI agent uploaded internal files to Pastebin. You can see what happened, but do you know why it did it?
Our latest post walks through how to use AI agent context during alert triage, even if your endpoint tooling doesn’t collect it for you.
phorion.io/blog/ai-agent-tri…
sysop_host retweeted
If you’re a blue teamer this series is worth throwing some eyes on 👀
We’re seeing a complete shift in endpoint activity as a result of chaotic AI workloads. Short term the noise is rough for security teams - but it’s all about finding the visibility and controls to adapt.
Part 1 of Phorion's Endpoint Security in the AI Age is here!
AI agents are changing endpoint security. Alert fidelity is dropping, and traditional tuning isn’t keeping up. A new era calls for a new approach to defending endpoints.
phorion.io/blog/ai-endpoint-…
sysop_host retweeted
TaskExplorer now natively integrates with Ollama 🤖
...so you can bring your favorite local LLM to the party!
Latest version available here:
objective-see.org/products/t…
I've just (re)written TaskExplorer
Think Process Monitor but for macOS, open source, & much more powerful 💪🏽
Highlights:
• CLI + JSON export
• On-device AI assistant
• Code signing + VirusTotal context
• Live process/file/dylib/network activity
objective-see.com/products/t…
sysop_host retweeted
This ClickFix campaign targets macOS users.
- press29[.]com is used to host the (2) shell scripts as well as the final payload.
- render-6[.]com appears to be used for statistical purposes in the second script.
The final payload is here: virustotal.com/gui/file/b123…
sysop_host retweeted
Always interesting to see how macOS malware is evolving, and what stays the same 📈🍎🐛
Solid report from @moonlock_com on macOS malware & threat trends from the first half of 2026.
Want to go deeper? 🔎
Explore the full Moonlock Lab mid-2026 macOS Threat Report, including threat data, attack trends, and recommendations for Mac users and security teams:
moonlock.com/mid-2026-macos-…
sysop_host retweeted
👾 New blog post about another macOS 27 privacy enhancement. Thx @ciphwall for a hint:
wojciechregula.blog/post/gol…
sysop_host retweeted
#OBTS v9 is offering more macOS & iOS trainings than ever before!
If you want to learn from the best (in sunny Hawaii), check them out:
Stoked to announce the #OBTS v9 trainings 🥳
🔗 objectivebythesea.org/v9/tra…
This year we’ve expanded to *six* trainings covering iOS & macOS: malware, threat hunting, reversing, vulnerability research, and more! 🍎🐛👾🔬🛡️
Trainings always sell out, so grab your spot today!
sysop_host retweeted
Our macOS VR training is coming to OBTS!! 🤙☀️🏖️
6️⃣ "macOS Vulnerability Research"
macosvuln.training/
Taught by @theevilbit and @gergely_kalman, this *new* training focuses on macOS vulnerability research (VR), with an emphasis on logic flaws and understanding Apple’s unique protections and attack surfaces.
sysop_host retweeted
30 days of DPRK activity on NPM. 108 packages, 261 versions and close to 700 indicators.
sysop_host retweeted
Hats off to Apple for bringing in some controls for ClickFix.
But I'm pretty stoked with how Phorion builds on top of this at an enterprise level with our clipboard protection 🍎
sysop_host retweeted
a lot of talk about the axios supply chain attack involving a macOS backdoor "WaveShaper" so thought it would be fun to do some old fashioned RE (like a dinosaur) youtube.com/watch?v=MfV56qPe…
Not exhaustive and looked at it "live" so may be missing some details :)
sysop_host retweeted
If you're looking for a framework to benchmark macOS EDR capabilities, checkout the latest update to the EDR Telemetry Project! 🍎
It is open-source and community-run.
If you have access to an EDR, consider submitting a PR to rank its capabilities!
@Kostastsale
edr-telemetry.com/blog/macOS…
🤖 Made with AI
ALT macOS EDR telemetry update
sysop_host retweeted
Playing with Apple’s latest ESF events took a little bit more work this time around!
I’ve written up a post on exploring the new undocumented socket bind events or ES_EVENT_TYPE_RESERVED_3 and _4.
phorion.io/blog/reverse-engi…
sysop_host retweeted
You can now build macOS firewalls/network tools via Endpoint Security - no Network Ext. needed! 🤯
Reversing macOS 24.6’s new ES_EVENT_TYPE_RESERVED_* ES events shows some are network auth/notify hooks
Read: “Building a Firewall…via Endpoint Security!?”
objective-see.org/blog/blog_…
sysop_host retweeted
Awesome job from the Phorion team on the results of the EDR Telemetry Project 🚀
edr-telemetry.com/macos
sysop_host retweeted
📢🍏 macOS is now part of the EDR Telemetry Project. After three months of focused work, we’re excited to share a new framework and generator for endpoint visibility on macOS!
Huge thank you to everyone who contributed and helped shape this release. Looking forward to what comes next.
Read more: edr-telemetry.com/blog/macOS…
sysop_host retweeted
Electron 41 is out!
It includes a new security feature I contributed and the team let me write a blurb in their announcement blog post! Shoutout and thanks to the team for working with me on this! I'm really enjoying contributing to Electron.
electronjs.org/blog/electron…
sysop_host retweeted
1/ Oh 🙊, here we go again!
Signed MacSync stealer dropper being delivered via zkcall[.]pro - a fully vibe-coded "secure messenger" for $199/month Premium tier.
Same fake app was documented by @txhaflaire in his MacSync write-up: jamf.com/blog/macsync-steale…
Nothing new here, just feels like a feature that’s ripe for abuse for initial access
0x626c6f67.xyz/posts/vscode-…
sysop_host retweeted
Here is an interesting one shared by @malwrhunterteam: f66645abf456e3f67fbcbeb78244c73735541ec2e6fd2e56cf2647823cb0eb99
shell script that downloads a (pretty annoying) obfuscated golang binary. script checks if running on macOS by checking if sw_vers exists, pretty cool.
🧵
