Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
Security researcher Ilias Morad, describes an impressive exploit chain, combining three macOS logic bugs he uncovered in macOS. His exploit chain allowed a local user to elevate privileges all the way to ring-0 (kernel)!
First reported Aug 01, 2020 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordUniversal binaries contain multiple architecture-specific Mach-O, known as slices ...however, it turns out the Apple API to identify the best slice is broken. Let's investigate and find out why!
First reported Feb 22, 2024 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordHere we deconstruct a Mac variant of GravityRAT (the cross-platform spyware, known to target the Indian armed forces).
First reported Nov 03, 2020 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence record@CodeColorist continues writing about bugs, such as CVE-2019-8521 and CVE-2019-8565 that provide a mechanism to elevate privileges to root on macOS.
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordIf you can programmatically generate synthetic mouse clicks, you can break macOS! Approving kernel extensions, dismissing privacy alerts, and much more more...
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordIn this guest blog post, the security researcher behind @OSCartography, describes a bug related to parsing property lists ...a bug that trivial crashed macOS!
First reported Oct 21, 2020 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordApple wrote code to appease the Chinese government ...it was buggy. In certain configurations, iOS devices were vulnerable a "emoji-related" flaw that could be triggered remotely!
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordThe Lazarus group's latest implant/loader supports in-memory loading of 2nd-stage payloads. In this post we describe exactly how to repurposing this 1st-stage loader to execute *our* custom 'fileless' payloads!
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordAfter the success of #OBTS v1.0, we decided to go international and plan #OBTS v2.0 in Europe! In this blog post, we re-live the highlights (from Monaco!) of "Objective by the Sea" v2.0.
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordIn part one of a guest blog post, @CodeColorist writes about several neat macOS vulnerabilities.
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordThe EFF/Lookout discovered a cross-platform implant, named CrossRat with ties to nationstate operators. Here, we tear it apart; analyzing its persistence mechanisms, features, and network communications.
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordIn this guest blog post @CodeColorist writes about a neat macOS vulnerability. Ironically, by abusing security mechanisms such as sandboxing, macOS can be coerced to load an untrusted library, into a SIP-entitled process!
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordOur annual report on all the Mac malware of the year - including samples for download, infection vectors, persistence mechanisms, payloads and more!
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordThe prolific adware known as Shlayer continues to evolve in creative ways! In this guest blog post, security researcher Taha Karim, details an unusual Shlayer sample that encrypts its configuration within the DMG file header structure.
First reported Dec 27, 2022 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordA 0day logic flaw in Microsoft Excel leads to 'remote' code execution on macOS, via malicious macros.
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordMalicious Spotlight plugins can leak bytes from TCC-protected files. And while the core bug was publicly disclosed almost a decade ago, it's still present in macOS 26!
First reported Sep 15, 2025 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordTiny SHell is a lightweight backdoor used in APT attacks against Mac users. In this (guest) post, the noted macOS security researcher (and #OBTS speaker!) Jaron Bradley provides a comprehensive analysis!
First reported Jun 01, 2020 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordA core Mojave utility is rather disastrously broken - causing a full-system lockup. Let's find out why!
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordOn my flight to ShmooCon, I managed to panic my fully-patched MacBook. Here we analyze the kernel panic report, finding that Apple's AMDRadeonX4150 kext is responsible for the crash.
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordOur annual report on all the Mac malware of the year - including samples for download, infection vectors, persistence mechanisms, payloads and more!
First reported Jan 01, 2021 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordApple will bring TCC events to Endpoint Security in macOS 15.4. In this post, we covers details, nuances, and provide PoC code for the new 'ES_EVENT_TYPE_NOTIFY_TCC_MODIFY' event.
First reported Mar 27, 2025 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordFrom a security point of view, pirating software is not recommended! Let's analyze a pirated application that contains a (malicious) surprise.
First reported Jan 15, 2024 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordA report from the Cybersecurity & Infrastructure Security Agency detailed "[A] North Korean State-Sponsored APT Target[ing] Blockchain Companies." We build upon CISA's report, diving deeper into one of the malicious macOS samples.
First reported May 09, 2022 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordToday we uncover two (local) security flaws in Zoom's latest macOS client. First, a privilege escalation vulnerability, and second, a method to surreptitiously access a user's webcam and microphone (via Zoom).
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordA filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.