Patrick Wardle

🛠 🍎 👾 Objective-See'ing & DoubleYou'ing

[Patrick Wardle @patrickwardle]

Stoked for the next (ad)venture: "DoubleYou" https://t.co/DpPe5fQxzV

Cofounded w/ long-time friend @hexlogic, we're empowering those building security tools for Apple devices 🍎🛡️

And by bootstrapping this venture, our core value of democratizing security remains our focus!

[Patrick Wardle @patrickwardle]

macOS 26: the leaf cert. used to sign 🍎 -binaries is now "macOS Software Signing" (prev. "Software Signing").

Intermediate ("Apple Code Signing Certification Authority") & root ("Apple Root CA") unchanged.

Relevant to some security tools (e.g. LuLu) that cared about this! 👀

[0xor0ne @0xor0ne]

My team at Apple SEAR is hiring an offensive security researcher focused on wireless security!

Apply here: https://t.co/sGXxU9pFqs

We're looking for talented researchers who love breaking wireless stacks and protocols like cellular/baseband, Wi-Fi, Bluetooth, or other wireless technologies.

Feel free to reach out if you have any questions.

#infosec

[Patrick Wardle @patrickwardle]

Sometimes simple bugs are the best! 🙌🏼

"the PasswordManagerBrowserExtensionHelper binary logged the session PIN to the system log via os_log" 🔓🫠

Thanks for sharing your research/writeup @joshparnham 🙏🏽

[Josh Parnham @joshparnham]

Published a writeup on CVE-2025-24169, a macOS vulnerability which allowed a malicious app to enumerate a user's saved account data in the Passwords app - contravening TCC protections.

Example PoC + full details here: https://t.co/rEHIk4y09N

[Objective-See Foundation @objective_see]

🚨 The CFP for #OBTS v9 closes this Friday (July 31)!

Have some novel or innovative Apple security research to share? We'd love to see your submission:
https://t.co/7Sb2N54gZd

Welcoming submissions on any Apple security topic (offensive & defensive)! 🍎🐛🛡️

[Moonlock Lab @moonlock_lab]

1/ New #macOS bash dropper - 0 hits on VT. Shared by @malwrhunterteam.

Self-deletes on launch. Delivers a binary from weekly-up[.]online while pushing a fake Zoom, Teams, or SystemApp as cover.
Might be related to Contagious Interview, however no strong confirmation yet. 🧵

[Objective-See Foundation @objective_see]

Also, have posted a sample of PamStealer to our free/public Mac Malware repo! 🍎🐛

PamStealer:
https://t.co/uj0wVy0kiO (pw: infect3d)

#SharingIsCaring

[Objective-See Foundation @objective_see]

Just added a sample of CrashStealer our free public Mac malware repo! 🍎🐛

CrashStealer:
https://t.co/Rt0ogVvtI5 (pw: infect3d)

#SharingIsCaring

[Stuart Ashenbrenner 🇺🇸 🇨🇦 @stuartjash]

One of the most time consuming parts of macOS research is identifying what you're looking at - AMOS, NovaStealer, DigitStealer, MacSync, or maybe Shlayer or Adload.

You can now pull in this Malware Research skill to help you classify malware quickly.
https://t.co/rPFZGnGuwD

[Olivia Gallucci ✨ @OliviaGalluccii]

INSANE line up for #OFTW

[0xor0ne @0xor0ne]

Apple SEAR is hiring an offensive security researcher focused on wireless security!

We're looking for talented researchers to help find and exploit vulnerabilities across wireless technologies.

Apply here: https://t.co/sGXxU9pFqs

If you love digging into wireless stacks and protocols like cellular/baseband, or Wi-Fi and Bluetooth, my team would especially like to hear from you.

Feel free to reach out if you have any questions.

#infosec

[Patrick Wardle @patrickwardle]

Stoked to be presenting at the next "Berlin MacAdmins Meetup" 🤩🇩🇪 If you're around the Berlin area, join us!

ℹ️Tuesday, July 28th 7:00 - 10:00 PM

For more details & registration: https://t.co/kA0bYBSpiU

Mahalo to @JamfSoftware for sponsoring the event!🙏🏽

[Patrick Wardle @patrickwardle]

https://t.co/xF75NfwXZQ (via @philofishal) 🍎👾

[Patrick Wardle @patrickwardle]

@XorNinja ...and "Objective By The Sea" 🤞🏼

[Blacktop @blacktop__]

NEW blog series 🎉 ... oh wait does this mean I have to blog consistently now 🫪😏

[Vector 35 @vector35]

Should be on dev soon! Thanks for the nudge and testing.

[Patrick Wardle @patrickwardle]

Looks like @vector35 added this to Binary Ninja over the weekend! 🤯🔓🍎👾

Currently just in a (soon-to-be-released) internal build, but looking solid already! 💪🏽

Mahalo @psifertex 🤩

[Patrick Wardle @patrickwardle]

Didn't realize @HexRaysSA's IDA has a config to decrypt Apple-protected binaries - neat!

Even better, Hopper does it automatically 🙌🏼

btw 🔑 is : "ourhardworkbythesewordsguardedpleasedontsteal(c)AppleComputerInc"

@ninja_binary, this would be a great feature to add 🍎🔓

[[email protected] @CodeColorist]

Some observations from disassembly that might be related to iOS 27 performance boost

https://t.co/MvHDXiSe8o

[Csaba Fitzl @theevilbit]

Our next macOS Vulnerability Researcher trainings with @gergely_kalman will be:

📆 2026-10-12 - 15: Self-organized, 4 (!!!!) day training (Budapest, Hungary)

📆 2026-11-15 - 17: Objective by the Sea v9 (Hawaii, USA)

More info here:
https://t.co/SQ4zNuVa6T

[Patrick Wardle @patrickwardle]

Worried about losing your coding skills due to AI?
...don't if you're using Xcode 🫠 Its AI integration is beyond flakey so you'll (still) be writing lots of code! 😵‍💫

Seems related to session handling, but signing in/out (e.g, into Claude), restarting Xcode, super hit & miss 🤷‍♂️

[Patrick Wardle @patrickwardle]

@keskinonur @objective_see Yes, macOS is very chatty network-wise, which is why LuLu ignores Apple-signed programs by default 🫣

Unfortunately, on macOS 27 beta there appears to be an Apple bug that breaks this behavior. Hoping for a fix from Apple in the next beta! 🤞🏼

https://t.co/G8V6cL6PGV