MacSec Labs

Advanced hands-on macOS security training. Red team tradecraft, reverse engineering, exploitation & evasion. Built by operators, for operators

[MacSec Labs @MacSecLabs]

MacSec Labs major release is live.

MRTO (macOS Red Team Operator) and MRE (macOS Reverse Engineer) are now open for exam booking.

MRTO is an 8-hour hands-on operator exam built around a realistic multi-Mac internal network, covering recon, native macOS privilege escalation, lateral movement, evidence capture, and operator decision-making under time pressure.

MRE is an 8-hour practical reverse engineering exam built around a custom macOS application. Students work through triage, Mach-O analysis, symbols, Objective-C and Swift behavior, LLDB, runtime validation, and hidden-key recovery.

We also shipped a major Red Team Tradecraft refresh with new and updated modules covering TCC boundaries, Gatekeeper and quarantine tradecraft, Apple-native Remote Events execution paths, SMB-based movement, and more macOS-specific operator workflows.

Book your exam now: https://t.co/imt8WeGdUv

#macOS #RedTeam #ReverseEngineering #infosec #OffensiveSecurity #CyberSecurity #EthicalHacking #PenTesting #SecurityTraining

[MacSec Labs @MacSecLabs]

MRTE (macOS Red Team Expert) just received a major refresh.

If you already understand core macOS red team tradecraft and want to go deeper, this is the next step.

The updated Advanced Evasion track now covers enterprise Mac operator tradecraft:

Exploiting Active Directory from a domain-joined corporate Mac
Native macOS Kerberos abuse, LDAP recon, LAPS, and delegation paths
Managed profile and policy abuse
Developer workstation trust boundaries and supply-chain abuse
EDR visibility, Endpoint Security pressure, and evasion tradecraft
Tunneling, Apple-native lateral movement, and compiler trust boundaries
Apple Silicon, GPU, Metal, and visibility limits

Built for operators who want to understand how macOS tradecraft holds up inside a real enterprise environment.

Promotional offer: enroll now and receive 500 lab hours with a 30 days validity. The lab features two AD-joined MacBooks and a domain controller to play with.

https://t.co/w6RuS7N8Oe

#macOS #RedTeam #ReverseEngineering #infosec #OffensiveSecurity #CyberSecurity #EthicalHacking #PenTesting #SecurityTraining

[MacSec Labs @MacSecLabs]

🚀 𝗧𝗵𝗲 𝗺𝗮𝗰𝗢𝗦 𝗥𝗲𝗱 𝗧𝗲𝗮𝗺 𝗟𝗮𝗯 𝗶𝘀 𝗟𝗜𝗩𝗘!

After months of building, MacSec Labs is officially opening its browser-based macOS Red Team lab environment, purpose-built for the macOS Red Team Tradecraft course.

No local VMs. No painful setup. Just sign in, complete MFA, and you're dropped into a real, managed macOS environment ready for hands-on tradecraft.

What you get:
 • A genuine macOS lab - not a simulation
 • 500 lab hours to practice, break things, and learn (Promotional offer)
 • Fully browser-based - work from anywhere

macOS offensive security has always been underserved when it comes to realistic, accessible practice environments. We're changing that.

This is our pilot phase, and we're actively refining the experience based on real learner feedback. If you're working in offensive security, red teaming, or just want to sharpen your macOS skills, this is for you.

https://t.co/aN5uvXX2AV

#RedTeam #macOS #OffensiveSecurity #CyberSecurity #InfoSec #EthicalHacking #PenTesting #SecurityTraining

[MacSec Labs @MacSecLabs]

MacSec Labs just added macOS Supply chain tradecraft path, and it's now live in our Red Team Advanced Evasion track.

We break down how trusted Swift package and compiler workflows quietly become an operator surface during compilation. No hand-waving. You get controlled lab evidence, command-execution proof, package-delivery context, and engagement-ready reporting.

This is not theory. This is hands-on macOS offensive research built for authorized red teams who want tradecraft that actually holds up in the field.

If you run macOS engagements, this is the edge you've been looking for. 👇

https://t.co/w6RuS7N8Oe

#redteam #infosec #OffensiveSecurity #CyberSecurity #EthicalHacking #PenTesting #SecurityTraining

[MacSec Labs @MacSecLabs]

@HiggsSec We publish under MacSec Labs because the training is built and reviewed by more than one contributor. Hari is one of the people behind the work for the offensive security track, but the course material is a MacSec Labs project, not a personal blog

[MacSec Labs @MacSecLabs]

MacSec Labs content is published under the MacSec Labs name. We do not list individual researcher names because multiple contributors from different regions help build and review the material. If you want to see one contributor's public research work, this blog is a good reference: https://t.co/NP1ryb1Epy

[MacSec Labs @MacSecLabs]

@HiggsSec https://t.co/AlZ68xcHFQ

[Arin Waichulis @arinwaichulis]

Stoked that @MacSecLabs gave me access to its Vulnerability Research tracks. Planning a deeper dive this weekend.

From what I've seen so far, this looks incredible for anyone getting into macOS security.

[MacSec Labs @MacSecLabs]

This is the most sophisticated macOS covert channel we have published.

A process with zero network code carries full C2 traffic through Mach exception delivery. Commands in. Data out. Endpoint Security does not generate a single event because the channel runs through kernel Mach traps, not the syscall layer ES monitors.

The sophistication is the attribution split. The sender lives inside the target and only triggers memory faults. The receiver makes every network call. EDR watches both processes independently and never connects the faults to the traffic.

Outbound data rides in the fault address. Inbound commands ride back through thread state modification the receiver writes to the sender. A complete bidirectional channel with no networking code in the implant itself.

Silent Signal Pathways is live now in the Red Team Tradecraft course. And there is more coming. Several novel phases are already in development, and members get every one of them at no extra cost.

We are running out of limited seats at the current price. Once they fill, the price increases. If you are not in the course yet, now is the time to get in before that happens.

https://t.co/6MapxU5I6t

#RedTeam #macOS #OffensiveSecurity #CyberSecurity #InfoSec #EthicalHacking #PenTesting #SecurityTraining

[MacSec Labs @MacSecLabs]

MacSec Labs will be talking at DEF CON this year on Advanced EDR Evasion via Metal GPU.

That research becomes a full module in our Advanced Evasion course.

But you don't have to wait until DEF CON to learn something new. We just dropped

AE 12: Endpoint Security Queue Pressure and EDR Visibility Gaps.

Available now in the Advanced Evasion course

https://t.co/6MapxU5I6t

5 modules. Build a synthetic macOS EDR from scratch using Apple's own Endpoint Security framework. Then break it by saturating its event queue until the kernel silently drops your payload's execution events.
Apple's own seq_num API confirms the drops. We use it as proof.

What you build:
A real ES client that monitors process execution
A flood generator that overwhelms it with coordinated event pressure
A tagged payload that executes during the saturation window

What you prove:
ES NOTIFY events are silently dropped when the client queue is full
The kernel does not warn the client
A payload in the drop window has its execution event lost.

#RedTeam #OffensiveSecurity #CyberSecurity #InfoSec #EthicalHacking #PenTesting #SecurityTraining #EDREvasion

[MacSec Labs @MacSecLabs]

MacSec Labs identified a Heap Overflow in Apple's EXR Decoder: CVE-2026-28977.

One overflow. One shared library. Flawed across iPhone, iPad, Mac at the same time, because they all ship the same decoder.

No tap. No open. The victim does nothing. Here's how a single crafted image corrupts memory on every Apple platform

This is the exact process we teach. Most Apple security training stops at macOS but MacSec Labs cover both MacOS and IOS.
One platform for the full Apple attack surface. Our macOS and iOS vulnerability research tracks are built from 10+ years of real bounty hunting on Apple platforms and kernels, hands-on, current, and grounded in live findings like this one, not theory.

Course: https://t.co/6MapxU5I6t

Writeup: https://t.co/h9nfWTVGgq

#RedTeam #OffensiveSecurity #CyberSecurity #InfoSec #EthicalHacking #BugBounty #SecurityResearch #SecurityTraining

[MacSec Labs @MacSecLabs]

@nkr1x Please use MacSecLabs Contact Us form if you have any questions.
https://t.co/O7EtaRChPT

[MacSec Labs @MacSecLabs]

Behind the Golden Gate: macOS 27 just rewrote the rules for red teamers.

New module just dropped in the MacSec Labs Red Team Tradecraft course.

Every macOS release shifts the ground under operators. Golden Gate is no exception. Kernel changes. New daemons. A fresh AI attack surface most red teams have not even mapped yet.

Our researchers have been in the beta since day one. The findings are now in the hands of our students.
What the new module covers:

Kernel, daemon, and operator delta on macOS 27. Siri AI entitlement mapping and the TCC-exempt surface. Apple Intelligence daemon recon. App Intents XPC surface mapping. Foundation Models CLI for local AI operator workflows. ES visibility testing and evasion with estrace. A full Golden Gate Tradecraft Survival Matrix.

Here is the promise. As the landscape changes, the courses get a complete refresh built around the current threat picture. Students always train on what matters right now, not what mattered last year.

MacSec Labs is your one stop learning platform for Mac and iOS. Stay ahead of every Apple change so you never play catch up.

Red Team Tradecraft was our top seller in the first 10 days of launch. Only a few seats remain before pricing flips to standard pricing.

Get in before the Golden Gate closes.

https://t.co/6MapxU5I6t

#RedTeam #macOS #OffensiveSecurity #CyberSecurity #InfoSec #EthicalHacking #PenTesting #SecurityTraining

[MacSec Labs @MacSecLabs]

Mac red-team tooling is changing.

We built a Mac-native Agentic C2 that doesn't look like the usual command console. It uses CoreML/ANE-assisted tasking, server-side LLM reasoning, human-in-the-loop approvals, MITRE mapping, KPI/KRI operator dashboards, and audit-ready execution trails.

Our researchers have been battle-testing this workflow across controlled EDR-backed environments, with no detections observed in our validation runs.

This is the foundation for our upcoming course: macOS Agentic Red Team Operations.

Students enrolled will receive access to the MacSec Agentic C2 source code and learn how to build, extend, and harden the platform, from operator workflow to agentic decision loops.

Pre booking is open now. Full access opens July 30th.

https://t.co/6MapxU5I6t

#RedTeam #macOS #OffensiveSecurity #CyberSecurity #InfoSec #EthicalHacking #PenTesting #SecurityTraining #bugbounty

[MacSec Labs @MacSecLabs]

Exciting news!

Since announcing our macOS Kernel Vulnerability Research course, the response has been incredible, far beyond what we expected. Because of that demand, we're releasing it earlier than originally planned. The course is available now.

It distills 10+ years of real-world kernel bounty hunting into a hands-on curriculum with working proof-of-concepts at every step.

Check it out here: https://t.co/x6Eg2J5XBd

#RedTeam #macOS #OffensiveSecurity #CyberSecurity #InfoSec #EthicalHacking #PenTesting #SecurityTraining #BugBounty

[MacSec Labs @MacSecLabs]

@UnsaltedHash42 Absolutely. For all the labs, you have the option to download the PoC/payload, which you can use on your own Mac. The online lab is an option for people who don’t have a Mac to learn on; they can make use of the online lab. Online lab is not compulsory.

[MacSec Labs @MacSecLabs]

🚀 𝗧𝗵𝗲 𝗺𝗮𝗰𝗢𝗦 𝗥𝗲𝗱 𝗧𝗲𝗮𝗺 𝗟𝗮𝗯 𝗶𝘀 𝗟𝗜𝗩𝗘!

After months of building, MacSec Labs is officially opening its browser-based macOS Red Team lab environment, purpose-built for the macOS Red Team Tradecraft course.

No local VMs. No painful setup. Just sign in, complete MFA, and you're dropped into a real, managed macOS environment ready for hands-on tradecraft.

What you get:
 • A genuine macOS lab - not a simulation
 • 500 lab hours to practice, break things, and learn (Promotional offer)
 • Fully browser-based - work from anywhere

macOS offensive security has always been underserved when it comes to realistic, accessible practice environments. We're changing that.

This is our pilot phase, and we're actively refining the experience based on real learner feedback. If you're working in offensive security, red teaming, or just want to sharpen your macOS skills, this is for you.

https://t.co/aN5uvXX2AV

#RedTeam #macOS #OffensiveSecurity #CyberSecurity #InfoSec #EthicalHacking #PenTesting #SecurityTraining

[MacSec Labs @MacSecLabs]

We found a KASLR bypass in macOS IOKit. Two services leaked live kernel heap addresses to any unprivileged, sandboxed user. Apple Security Bounty, CVE-2026-20695, fixed in macOS Tahoe 26.4.

This is the exact process we teach in our new course: macOS Kernel Vulnerability Research. Built from 10+ years of real bounty hunting on the kernel and beyond, not theory.

Course: https://t.co/x6Eg2J5XBd

Writeup: https://t.co/pM8vBI8p8S

#RedTeam #macOS #OffensiveSecurity #CyberSecurity #InfoSec #EthicalHacking #PenTesting #SecurityTraining #BugBounty

[MacSec Labs @MacSecLabs]

@UnsaltedHash42 Hi, i have added bundle offer to the pricing page on our website.