REPORT1 SOURCE
The Hidden Treasures of Crash Reports
Analyzing crash reports reveals malware, (0-day) bugs, and much more!
First reported Aug 13, 2024 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordÆ / PUBLIC MALWARE INTELLIGENCE
Follow the evidence.
Published file metadata, source observations, indicators, and research history in one bounded catalog.
100Reachable catalog records
1 / 5Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.
Review source update dates and status
- src_e03c0eb81ecbe60444Collection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
100 MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
REPORT1 SOURCE
SysJoker, the first (macOS) malware of 2022!
Here, we analyze the macOS versions of a cross-platform backdoor.
First reported Jan 11, 2022 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordREPORT1 SOURCE
This Meeting Should Have Been an Email
A DPRK stealer, dubbed BeaverTail, targets users via a trojanized meeting app. Let's analyze it comprehensively.
First reported Jun 15, 2024 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordREPORT1 SOURCE
Breaking macOS Mojave (Beta)
In macOS Mojave apps, to have to obtain user permission before using the Mac camera & microphone. We'll illustrate how this is trivial to bypass (at least in the current beta).
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordREPORT1 SOURCE
OSX.CDDS (MacMa): A Sophisticated Watering Hole Campaign Drops A New macOS Implant!
A nationstate attack leverages n-/0-day exploits to persistently infect Apple systems with a new macOS implant.
First reported Nov 11, 2021 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordREPORT1 SOURCE
Analyzing OSX/CreativeUpdater
Recently, the popular MacUpdate website was subverted to distribute a new macOS cryptominer; OSX/CreativeUpdater.
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordREPORT1 SOURCE
Ironing out (the macOS) details of a Smooth Operator (Part II)
Analyzing UpdateAgent, the 2nd-stage macOS payload of the 3CX supply chain attack
First reported Apr 01, 2023 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordREPORT1 SOURCE
The Mac Malware of 2018
Our annual report on all the Mac malware of the year - including samples for download, infection vectors, persistence mechanisms, payloads and more!
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordREPORT1 SOURCE
Catching macOS Stealers in the Wild
macOS stealers continue to be a pervasive threat! In this guest blog post, one of our #OBTS student scholars, Pablo Redondo Castro, shares the technical details of a macOS stealer (likely AMOS-related) he analyzed.
First reported Apr 01, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordREPORT1 SOURCE
Analysis of CVE-2021-30860
In this guest blog post, the security researcher Tom McGuire details the flaw and fix of CVE-2021-30860, a zero-click vulnerability, exploited in the wild.
First reported Sep 16, 2021 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordREPORT1 SOURCE
All Your Macs Are Belong To Us
This is our 100th blog post ...and it's a doozy! Here, we detail a bug that trivially bypasses many core Apple security mechanisms, leaving Mac users at grave risk!
First reported Apr 26, 2021 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordREPORT1 SOURCE
Arm'd & Dangerous
Apple's new M1 systems offer a myriad of benefits, that malware authors are now leveraging. Here, we detail the first malicious program, compiled to natively target Apple Silicon (M1/arm64)!
First reported Feb 14, 2021 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordREPORT1 SOURCE
Restoring Reflective Code Loading on macOS (Part II)
Let's continue our research into fully restoring reflective code loading on macOS — now with support for macOS 26 and in-memory Objective-C payloads. And what about detection? We cover that too!
First reported Nov 24, 2025 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordREPORT1 SOURCE
OSX.EvilQuest Uncovered (part one)
OSX.EvilQuest is a new piece of malware targeting Mac users. In part one, we analyze the malware's infection vector, persistence mechanism, and anti-analysis logic.
First reported Jun 29, 2020 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordREPORT1 SOURCE
Lazarus Group Goes 'Fileless'
The rather infamous APT group, "Lazarus", continues to evolve their macOS capabilities. Today, we tear apart their latest 1st-stage implant that supports remote download & in-memory execution of secondary payloads!
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordREPORT1 SOURCE
OSX.EvilQuest Uncovered (part two)
OSX.EvilQuest is a new piece of malware targeting Mac users. In part two, we analyze the malware's viral infection capabilities, and detail its insidious capabilities.
First reported Jul 03, 2020 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordREPORT1 SOURCE
The Dacls RAT ...now on macOS!
A sophisticated Lazarus Group implant has arrived on macOS. In this post, we deconstruct the Mac variant of a OSX.Dacls, detailing its install logic, persistence, and capabilities.
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordREPORT1 SOURCE
A Remote Pre-Authentication Overflow in LLDB's debugserver
In this guest blog post, Nathaniel Oh, details a recent bug he discovered and reported to Apple: a remote pre-authentication buffer overflow in LLDB’s debugserver, now patched as CVE-2025-43504.
First reported Dec 08, 2025 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordREPORT1 SOURCE
All Your Docs Are Belong To Us
Here, we reverse, then 'extend' a popular macOS anti-virus engine. With the creation of a new anti-virus signature, classified documents will be automatically detected!
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordREPORT1 SOURCE
A Deceitful 'Doctor' in the Mac App Store
A massively popular app from the official Mac App Store, surreptitiously steals your browsing history! By fully reversing the application, we can fully expose its functionality and rather shady capabilities.
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordREPORT1 SOURCE
Made In America: Green Lambert for OS X
In this guest blog post, the security researcher Runa Sandvik analyzes OSX.GreenLambert, a first-stage macOS implant utilized by the CIA.
First reported Oct 01, 2021 05:00 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordREPORT1 SOURCE
Sniffing Authentication References on macOS
CVE-2017-7170 was a local priv-esc vulnerability that affected OSX/macOS for over a decade! Here (for the first time!), we dive into the technical details of finding the bug, the core flaw, and exploitation.
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordREPORT1 SOURCE
Remote Mac Exploitation Via Custom URL Schemes
The WINDSHIFT APT group is successfully infecting Macs with a novel infection mechanism. By abusing custom URL scheme handlers and minimal user interaction, Macs can be remotely compromised!
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordREPORT1 SOURCE
[0day] Mojave's Sandbox is Leaky
The macOS sandbox is seeks to prevent malicious applications from surreptitiously spy on unsuspecting users. Turns out, it's trivial to sidestep some of these protections, resulting in significant privacy implications!
Collected Oct 08, 2026 03:48 UTCCatalog metadata updated Oct 08, 2026 03:48 UTCOpen evidence recordA filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.