AETERNAE AI RESEARCH LLC INDEPENDENT RESEARCH
ÆAETERNAERESEARCH
Sign inRequest access
Æ / PUBLIC MALWARE INTELLIGENCE

Follow the evidence.

Published file metadata, source observations, indicators, and research history in one bounded catalog.

100Reachable catalog records
2 / 5Current catalog page
24Maximum records per page
0Samples downloaded by this page

Feed collection status

Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.

1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.

Review source update dates and status
  • src_e03c0eb81ecbe60444Collection status unverifiedLast successful batch: Unverified

Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.

Clear filters
100 MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
REPORT1 SOURCE

Detecting SSH Activity via Process Monitoring

In this guest blog post, the noted Mac security researcher/author Jaron Bradley explains how to detect (potentially malicious) SSH activity...via process monitoring and the analysis of process hierarchies.

First reported Dec 10, 2020 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence record
REPORT1 SOURCE

The Mac Malware of 2021

It's here! Our annual report on all the Mac malware of the year (2021 edition). Besides providing samples for download, we cover infection vectors, persistence mechanisms, payloads and more!

First reported Jan 01, 2022 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence record
REPORT1 SOURCE

Block Blocking Login Items

Apple recently updated the way login items are stored by the OS. In this post, we'll illustrate how to parse the (new) login item files to detect persistence

Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence record
REPORT1 SOURCE

Low-Level Process Hunting on macOS

Parent-child relationships are one of the simplest and most effective ways to detect malicious activity at the host level ...however on macOS things can get a little complex. Luckily security researcher Jaron Bradley is here to explain exactly what is going on!

First reported Jul 19, 2020 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence record
REPORT1 SOURCE

Middle East Cyber-Espionage

The APT group WindShift has been targeting Middle Eastern governments with Mac implants. Let's analyze their 1st-stage macOS implant: OSX.WindTail!

Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence record
REPORT1 SOURCE

FinFisher Filleted

Interested in learning about a macOS cyber-espionage implant ...that leveraged priv-escalation exploits and a kernel-mode rootkit!? In this post, we analyze the macOS version of FinSpy.

First reported Sep 26, 2020 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence record
REPORT1 SOURCE

Where's the Interpreter!?

CVE-2021-30853 was able to bypass file quarantine, gatekeeper, & notarization requirements. In this post, we show exactly why!

First reported Dec 22, 2021 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence record
REPORT1 SOURCE

The Mac Malware of 2025

It's here! Our annual report on all the Mac malware of the year (2025 edition). Besides providing samples for download, we cover infection vectors, persistence mechanisms, payloads and more!

First reported Jan 01, 2026 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence record
REPORT1 SOURCE

No Paste for You!

In macOS 26.4, Apple added ClickFix protections. In this post, we reverse macOS to uncover exactly how these protections are implemented, and whether we can replicate the same approach in our own tools.

First reported Mar 31, 2026 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence record
REPORT1 SOURCE

Burned by Fire(fox) (Part II)

Recently, an attacker targeted (Mac) users via a Firefox 0day. In this second post, we fully reverse OSX.NetWire.A, revealing (for the first time!), its inner workings and complex capabilities.

Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence record
REPORT1 SOURCE

Detecting (Evil) Dylibs

Attackers are increasingly turning to dylibs to host malicious code, gain stealth, and inherit the trust of legitimate processes. In this blog post, we explore how to statically enumerate dylib dependencies, inspect libraries loaded into running processes, and leverage Endpoint Security to detect, and even block, malicious dylibs at load time.

First reported Aug 23, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence record
REPORT1 SOURCE

Mac Adware, à la Python

Let's tear apart a persistent piece of adware, decompiling, decoding, and decompressing it's code to uncover its methods and capabilities.

Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence record
REPORT1 SOURCE

An Insecurity in Apple's Security Framework?

Turns out that writing security tools is a great way to inadvertently uncover bugs in macOS. How about a crash in Apple's 'Security' framework ... that can't be good!?

Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence record
REPORT1 SOURCE

Burned by Fire(fox) (Part III)

Recently, an attacker targeted (Mac) users via a Firefox 0day. In this third post, we analyze a second backdoor used in the attack, detailing its persistence, capabilities, and ultimate identify it a new variant of the cross-platform Mokes malware!

Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence record
REPORT1 SOURCE

SeaFlower 藏海花

It's not everyday that we get to talk about backdoors targeting iOS users. In this guest blog post, security researcher Taha Karim, details a sophisticated threat targeting iOS web3 users.

First reported Jun 13, 2022 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence record
REPORT1 SOURCE

Who Moved My Pixels?!

In this guest blog post my friend Mikhail Sosonkin reverses Apple's screencapture utility, discusses Mac malware that captures desktop images, and suggests methods for screen-capture detection!

Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence record
REPORT1 SOURCE

Apple Approved Malware

Unfortunately we didn't have to wait long before hackers found a way to (ab)use Apple's new notarization service to get their malware approved! In this post, we tear apart an adware campaign that utilized malicious payloads containing Apple's notarization "stamp of approval".

First reported Aug 30, 2020 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence record
REPORT1 SOURCE

Building a Firewall ...via Endpoint Security!?

You can now build macOS firewalls/network tools via Endpoint Security ...no Network Extension needed! In this post, we reverse macOS 26.4's new ES_EVENT_TYPE_RESERVED_* ES events shows some are network auth/notify hooks.

First reported Mar 27, 2026 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence record
REPORT1 SOURCE

It's Turtles All The Way Down

Yet more ransomware targeting macOS! In this post we analyze the newly discovered "Turtle" ransomware and provide both a decryptor and a method to procactively thwart it.

First reported Nov 30, 2023 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence record

A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.