Bhargav Rathod

All things DFIR & Malware Analysis |

macOS/iOS DFIR & Malware Research |

Staff MDR Analyst @ Unit42 | OC-DFRWS | GIAC - GREM, GIME & Advisory Board Member

[Moonlock by MacPaw @moonlock_com]

Want to go deeper? 🔎

Explore the full Moonlock Lab mid-2026 macOS Threat Report, including threat data, attack trends, and recommendations for Mac users and security teams:

https://t.co/wVd1YGYNv0

[Moonlock Lab @moonlock_lab]

1/ Looks like #DigitStealer is still hard to detect on VT. @malwrhunterteam shared a file with us which led to Stage-1 compiled AppleScript. With multiple parallel scripts to execute, it remains a threat to #macOS users.
More info below 👇

[Jamf Threat Labs @JamfThreatLabs]

Meet CrashStealer. This one takes delivery more seriously than most, a signed and Apple-notarized dropper that's pulling its second stage payload down through GitHub.

The payload is a native C++ stealer with client-side AES-GCM encryption and layered anti-analysis.

Check out our writeup for additional details and indicators of compromise.

https://t.co/3IhuEmrsZj

#infostealer #malware #macos #threatresearch

[Bhargav Rathod @malwr4n6]

Super excited to speak at BSides Ahmedabad!

#artificialintelligence #ai #appleintelligence #apple

[Security BSides Ahmedabad @bsidesahmedabad]

Apple Intelligence is changing how millions interact with AI.

But how does it actually work under the hood? 🔥

We're thrilled to welcome Bhargav Rathod, Staff Analyst at Palo Alto Networks Unit 42, as a speaker at Upwind presents BSides Ahmedabad 0x7.

In his session, "Apple Intelligence Exposed: Reverse Engineering the AI Assistant," Bhargav will explore the architecture behind Apple's AI assistant, the techniques used to reverse engineer it, and the security insights that emerge from understanding its inner workings.

If AI security and reverse engineering are on your radar, this is a session you won't want to miss.

📍 Hyatt Regency, Ahmedabad
📅 26–27 September 2026

🎟️ Your seat is waiting. Book your spot: https://t.co/ppHZdsuaUv

#BSidesAhmedabad #BSidesAhmedabad0x7 #UpwindPresentsBSidesAhmedabad #AppleIntelligence #ReverseEngineering #AISecurity #Unit42 #CyberSecurity #InfoSec

[Bhargav Rathod @malwr4n6]

Glad to see our analysis being referenced by BleepingComputer!

[BleepingComputer @BleepinComputer]

New macOS ClickFix attack silently mounts DMGs to push infostealer
https://t.co/nDY4vXFZYG

https://t.co/nDY4vXFZYG

[Bhargav Rathod @malwr4n6]

Had fun digging into this!

The Clickfix tactic appears similar to what has been observed with Shalyer and the infostealer family looks like a variant of AMOS and Poseidon stealer

#macos #malware

[Unit 42 @Unit42_Intel]

The latest macOS ClickFix variant invisibly mounts DMG images in the background to execute a macOS infostealer and hijack cryptocurrency wallet info. Details at https://t.co/8Bg5ojzg26

[DFRWS @DFRWS]

Call for Practitioner Talks and Industry Presentations. Join us in Singapore October 19th-22nd for the Digital Forensics Conference. Accepting abstracts now!

https://t.co/TokwSOSMad

#DFRWS #DigitalForensicsResearch #DFIR
#CyberForensics #CallForProposals #ForensicScience

[Csaba Fitzl @theevilbit]

🍎🌁 Big changes to user TCC.db in macOS Golden Gate! It seems that it finally got the protection it deserves.

It was moved to:
/private/var/containers/Data/ProtectedSystem/[UUID]/Data/Library/Application Support/com.apple.TCC/

You can't access it even with FDA, and likely need "com\.apple.private.security.protected-system-container" entitlement to write to it.

[Calum Hall @_calumhall]

The power of Phorion Protections is nuts 🔥 Being built into the EDR gives you full historical analytics on any file/process controls that you implement.

Prevent anomalous activity wherever you can, and where you can’t - have the detections in place to catch edge cases.

[Objective-See Foundation @objective_see]

BlockBlock vs. https://t.co/TxGjyWiHba 🙅🏻‍♂️🛡️🐱

BlockBlock (https://t.co/JFIPg35zZq) alerts on persistence events, including the persistent payload from the Nx Console VS Code compromise that impacted @github 👀

[Moonlock Lab @moonlock_lab]

1/ℹ️We found a fully-featured macOS #RAT that zero AV vendors detected at the time of discovery.

Meet "3Crypt RAT/C2 Capability Tester" - a #macOS binary with deep recon, persistence, evasion, and lateral movement capabilities.

No real C2 infra. But don't let that fool you. 👇

[Mauro Eldritch 🏴‍☠️ @MauroEldritch]

🇰🇵 #Lazarus is back with a new macOS malware kit.

👷 Made up of multiple Mach-O binaries, we named it “Mach-O Man”. It is being distributed via #ClickFix in the crypto ecosystem to steal secrets.

▶️ Read my full article for ANY RUN below.

#DPRK #Malware

[Ryan Dowd @_rdowd]

Found a macOS TOCTOU bug while reviewing Apple EDR integrations at @HuntressLabs.
A non-admin user can delete TCC-protected content by hitting the right timing window. Came up unexpectedly during the review, which made it a fun one.

[Objective-See Foundation @objective_see]

New research from our friends/supporters @MacPaw / @moonlock_lab 👏

🍎👾🔬 New macOS stealer “notnullosx”: Go-based, modular, and going after everything from browser creds to crypto wallets.

Read: https://t.co/FfZWejZmPq

[Jamf Threat Labs @JamfThreatLabs]

ClickFix techniques are evolving.
Instead of copy and paste instructions to Terminal, newer variants are using Script Editor to execute payloads on macOS.
Read more about this delivery technique in our latest blog post.

https://t.co/NBNlMqcRF6

#clickfix #malware #threathunting

[Bhargav Rathod @malwr4n6]

The countdown to Black Hat Asia 2026 has begun! I'll be speaking on Apple Intelligence. Join me and the rest of the #cybersecurity community in Singapore. Get your pass: https://t.co/3COepZ9NmU
#BHASIA #singapore #apple #appleintelligence #digitalforensics

[Objective-See Foundation @objective_see]

Just released: BlockBlock v2.4

🆕 Notarization Mode ('All')
Blocks any non-notarized program (even those w/o quarantine attributes).

🆕 Heuristics for 'ClickFix'
Applies heuristics against pastes into terminals, blocking those deemed suspicious.

https://t.co/JFIPg367OY

[Bhargav Rathod @malwr4n6]

See y'all in Seoul!

[DFRWS @DFRWS]

Bhargav Rathod (Palo Alto Networks) leads a hands-on macOS forensics workshop at DFRWS APAC 2025. Learn practical techniques to investigate Apple devices in real-world cases.

👉 Check out the full program schedule and reserve your seat today: https://t.co/YfQfqsvD1C

[Bhargav Rathod @malwr4n6]

Checkout my talk at NullCon Goa 2025:

[NULLCON @nullcon]

At #NullconGoa2025, Bhargav Rathod of @salesforce, took us on a deep dive into macOS Lockdown Mode — dissecting its technical design & the challenges it poses for digital investigators.

Watch Now: https://t.co/atTAfL6F9I

#macOS #DigitalForensics #LockdownMode #Cybersecurity

[Bhargav Rathod @malwr4n6]

I'm thrilled to announce that, I'll be presenting my research on "macOS Lockdown Mode" at the best DFIR event of the year!

#macos #dfir #digitalforensics #Apple #sans

[SANS DFIR @sansforensics]

Join us at #DFIRSummit when @malwr4n6 dives into how macOS Lockdown Mode reshapes #DigitalForensics — what’s restricted, what changes, & what artifacts #DFIR pros can still uncover.

🗓️ Summit: Jul 24-25
📍 Salt Lake City & Free Live Online

➡️ Register: https://t.co/8xAvn3Har6