Objective-See Foundation

🍎 🛡️
🛠️ Open-Source Tools
📚 "The Art of Mac Malware" books
🫂 "Objective by the Sea" conference

Support us on 🙏

[Objective-See Foundation @objective_see]

Our Valentine's Day gift 💝
https://t.co/qjS1qRfbjR

Announcing Objective by the Sea (#OBTS) v9.0:
👩🏻‍💼 Train: Nov 15-17
👩🏻‍🏫 Talks: Nov 18-20
📍 Maui, Hawaii, 2026

CFP (talks & trainings) and tickets are now officially open! Hope to see you by the sea 🏝️

Special 🙏🏽 to @andyrozen!!

[Stuart Ashenbrenner 🇺🇸 🇨🇦 @stuartjash]

One of the most time consuming parts of macOS research is identifying what you're looking at - AMOS, NovaStealer, DigitStealer, MacSync, or maybe Shlayer or Adload.

You can now pull in this Malware Research skill to help you classify malware quickly.
https://t.co/rPFZGnGuwD

[Objective-See Foundation @objective_see]

Also, have posted a sample of PamStealer to our free/public Mac Malware repo! 🍎🐛

PamStealer:
https://t.co/uj0wVy0kiO (pw: infect3d)

#SharingIsCaring

[Virus Bulletin @virusbtn]

Jamf's Thijs Xhaflaire analyses PamStealer, a Rust-based macOS infostealer disguised as the legitimate Maccy clipboard manager that uses a two-stage attack chain to silently harvest data and clipboard contents while evading detection. https://t.co/Q6TdzGN1gY

[Objective-See Foundation @objective_see]

Just added a sample of CrashStealer our free public Mac malware repo! 🍎🐛

CrashStealer:
https://t.co/Rt0ogVvtI5 (pw: infect3d)

#SharingIsCaring

[Jamf Threat Labs @JamfThreatLabs]

Meet CrashStealer. This one takes delivery more seriously than most, a signed and Apple-notarized dropper that's pulling its second stage payload down through GitHub.

The payload is a native C++ stealer with client-side AES-GCM encryption and layered anti-analysis.

Check out our writeup for additional details and indicators of compromise.

https://t.co/3IhuEmrsZj

#infostealer #malware #macos #threatresearch

[Thoms Bosboom @thomasbosboom]

@coolestcatiknow @objective_see @MITREattack @MiscreantsHQ I’ve shared your OBTS vids with more folks than I can even remember - such great explainers. Thanks for the good work.

[L0Psec @L0Psec]

Here's a cool uncommon technique seen in a dylib (written in beautiful Swift) for an App that had its signature revoked. Grabbing a config from the https://t.co/aIfm81wntX.metadata:kMDItemFinderComment xattr of an app bundle using the getxattr() func. cool!

[Patrick Wardle @patrickwardle]

Stoked to be presenting at the next "Berlin MacAdmins Meetup" 🤩🇩🇪 If you're around the Berlin area, join us!

ℹ️Tuesday, July 28th 7:00 - 10:00 PM

For more details & registration: https://t.co/kA0bYBSpiU

Mahalo to @JamfSoftware for sponsoring the event!🙏🏽

[Moonlock Lab @moonlock_lab]

1/ New #macOS (crossplatform) sample: a full-featured remote access trojan masquerading as MicrosoftSystem64 and using #huggingface legitimate infrastructure for its C2 activities. JavaScript payload + RAT inside a Mach-O binary. Findings below 👇

[Unit 42 @Unit42_Intel]

The latest macOS ClickFix variant invisibly mounts DMG images in the background to execute a macOS infostealer and hijack cryptocurrency wallet info. Details at https://t.co/8Bg5ojzg26

[Objective-See Foundation @objective_see]

Just added the OSX.Gaslight sample to our public Mac malware repo:

https://t.co/FXQX7cnZVx (pw: infect3d)

#SharingIsCaring

[Patrick Wardle @patrickwardle]

https://t.co/xF75NfwXZQ (via @philofishal) 🍎👾

[Project Zero Bugs @ProjectZeroBugs]

apple-zlib: uninitialized memory leak during decompression in inflate https://t.co/3TIAHTxm08

[Patrick Wardle @patrickwardle]

Lineup for the next (free!) Objective for the We #OFTW is 🔥

📍 Berlin
🗓️ July 30–31, 2026

Join us! 🤩

Only ~2 weeks left to apply:
https://t.co/uDfGVDG0hR

[Luke Roberts @rookuu_]

Neat addition to EndpointSecurity with deadline manipulation in the macOS 27 beta

[Objective-See Foundation @objective_see]

ℹ️ BlockBlock v2.5.0 adds a new feature that can alert you whenever a downloaded script is about to execute.

Designed to complement "Notarization" Mode, it provides an additional layer of protection against potentially unsafe content before it runs. 🛡️

https://t.co/JFIPg35zZq

[Ivan Krstić @radian]

🔺NEW: Apple is expanding Private Cloud Compute (PCC) beyond our data centers. PCC on Google Cloud: NVIDIA Confidential Computing, Intel TDX, and Google's Titan chip, with capabilities that go far beyond a traditional confidential computing deployment. https://t.co/DF2Hw8HUZH

[Patrick Wardle @patrickwardle]

yasss, this is delightful 🤩

Handling ES deadlines has always been complex(ish) (e.g. don't forget to use a mach_timebase_info when converting "mach time" to nanoseconds on Apple Silcon!) 😵‍💫

...and if you got it wrong (and missed a deadline) the kernel would just kill you! ☠️

[Objective-See Foundation @objective_see]

Just added a few samples of "FlutterShell" to our free public macOS malware repo:

https://t.co/Gt0M2kS10U (pw: infect3d)

#SharingIsCaring

[Patrick Wardle @patrickwardle]

New macOS Backdoor "FlutterShell" 🍎🐛

Discovered & analyzed by @PaloAltoNtwks @Unit42_Intel 🙌🏼

"weaponizes AI summarization features for data exfiltration by routing documents through an attacker-controlled server before processing them " 👀🔥

https://t.co/mj6h27q3Ss

[Objective-See Foundation @objective_see]

Stoked that @Rippling has joined our "Friends of Objective-See" program in support of our non-profit foundation 😍

Their support helps our:
🛠️ open-source tools
📚 free #TAOMM books
👨‍👩‍👦 community-driven #OBTS/#OFTW events
...continue to grow & thrive!

https://t.co/rs89ZMdv47

[Objective-See Foundation @objective_see]

Love our free, open-source macOS security tools?

You can support their continued development on Patreon https://t.co/9fPCFoCgVC 🙏🏽😍

[Objective-See Foundation @objective_see]

You asked, we listened 😇

"DoNotDisturb" v2.1 adds 'Trusted Unlock' mode

When enabled, if a lid-open event is followed by a successful Touch ID or unlock via your Apple Watch, DND can ignore it, reducing false alarms while still watching for evil maids.

https://t.co/WHKNnDOsWb

[Billy Ellis @bellis1000]

Uncovering an iOS 26.5 ImageIO Vulnerability https://t.co/fOUbgFkTqs