Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
In this guest blog post, "Objective by the Sea" speaker, Csaba Fitzl writes about an interesting way to get root via Apps from the official Mac App Store!
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordIn this guest blog post, the security researcher Taha Karim of ConfiantIntel, dives into a new macOS adware specimen: Hydromac.
First reported Jun 04, 2021 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordAre full paths and preview thumbnails for files even on encrypted containers and removable usb devices really persistently stored? ...yes :( Apple's 'QuickLook' cache is to blame.
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordClickFix represents a shift in attacker tradecraft, exploiting user trust rather than software vulnerabilities. In this post, we introduce a lightweight execution-boundary defense that intervenes at paste time to generically disrupt most ClickFix-style attacks on macOS.
First reported Feb 15, 2026 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordA new Mac malware targets the cryptocurrency community. In this post, we dive into the malware and illustrate how Objective-See's tools can generically thwart this new threat at every step of the way.
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordIn this guest blog post, the Mac security researcher Csaba Fitzl, descrbibes his journey creating an app to protect against process injection on macOS.
First reported Mar 03, 2021 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordIt's here! Our annual report on all the Mac malware of the year (2022 edition). Besides providing samples for download, we cover infection vectors, persistence mechanisms, payloads and more!
First reported Jan 01, 2023 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordToday, Valentine's day, is a day to celebrate love, and for better or worse one my main loves is malware. Let's analyze a new macOS backdoor/updater component: 'iWebUpdate' ...which has been around, undetected for 5 years!
First reported Feb 14, 2023 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordDazzleSpy is a fully-featured cyber-espionage macOS implant, installed via a remote Safari exploit!
First reported Jan 25, 2022 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordThe first malware of 2024 is (already) here. Let's dive in!
First reported Jan 04, 2024 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordDid you know on macOS, notifications are stored in a unencrypted database? Which means that even 'disappearing' messages from apps such as Signal - may not really disappear. Yikes!
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordA new macOS backdoor written by the infamous Lazarus APT group needs analyzing. Here, we examine it's infection vector, method of persistence, capabilities, and more!
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordOSX/MaMi (the first Mac malware of 2018) hijacks infected users' DNS settings and installs a malicious certificate into the System keychain, in order to give remote attackers 'access' to all network traffic
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordThe APT group WindShift has been targeting Middle Eastern governments with Mac implants. Let's (continue to) analyze their 1st-stage macOS implant: OSX.WindTail!
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordIt's here! Our annual report on all the Mac malware of the year (2023 edition). Besides providing samples for download, we cover infection vectors, persistence mechanisms, payloads and more!
First reported Jan 01, 2024 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordAttackers are leveraging trojanized appplications to spread malware, via sponsored search results.
First reported Sep 14, 2021 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordLearn how to leverage Apple's new Endpoint Security Framework to create a comprehensive (user-mode) Process Monitor for macOS 10.15!
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordThe first (macOS) malware of 2021 is an insidious remote access tool (RAT), containing a variety of embedded payload to extend its functionality.
First reported Jan 05, 2021 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordHere we continue to deconstruct a Mac variant of GravityRAT (the cross-platform spyware, known to target the Indian armed forces), focusing on its Electron component.
First reported Nov 27, 2020 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordIt's here! Our annual report on all the Mac malware of the year (2024 edition). Besides providing samples for download, we cover infection vectors, persistence mechanisms, payloads and more!
First reported Jan 01, 2025 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordIn this guest blog post, researcher Noah Gregory shares the technical details of a bug he uncovered (that was subsequently patched by Apple as CVE-2024-5447).
First reported Mar 20, 2025 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordImagine you've gained remote code execution on a Mac via a malicious Word document. Turns out, you're still stuck in a sandbox. However, via a faulty regex, you can escape and persist!
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordIn this guest blog post, security researcher Matt Shockley describes a lovely security vulnerability he uncovered in macOS. This bug allowed for a complete bypass of TCC's draconian entitlement checks, all without writing a single line of code!
First reported Jul 28, 2020 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordThe 3CX supply chain attack gives us an opportunity to analyze a trojanized macOS application! Here, we uncover the malicious component and thoroughly analyze its capabilities.
First reported Mar 29, 2023 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordA filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.