sysop_host

Hacker, security geek, climber, spanner monkey, and occasional builder of rally cars

[sysop_host @sysop_host]

@L0Psec @malwrhunterteam This was a fun one, purely just for the creative obfuscation https://t.co/8mx9cVFJDR

[Patrick Wardle @patrickwardle]

#OBTS v9 is offering more macOS & iOS trainings than ever before!

If you want to learn from the best (in sunny Hawaii), check them out:

[Csaba Fitzl @theevilbit]

Our macOS VR training is coming to OBTS!! 🤙☀️🏖️

[audityourcontracts @AuditUrContract]

30 days of DPRK activity on NPM. 108 packages, 261 versions and close to 700 indicators.

[Calum Hall @_calumhall]

Hats off to Apple for bringing in some controls for ClickFix.

But I'm pretty stoked with how Phorion builds on top of this at an enterprise level with our clipboard protection 🍎

[L0Psec @L0Psec]

a lot of talk about the axios supply chain attack involving a macOS backdoor "WaveShaper" so thought it would be fun to do some old fashioned RE (like a dinosaur) https://t.co/NwAXfTKQsO

Not exhaustive and looked at it "live" so may be missing some details :)

[Olivia Gallucci ✨ @OliviaGalluccii]

If you're looking for a framework to benchmark macOS EDR capabilities, checkout the latest update to the EDR Telemetry Project! 🍎

It is open-source and community-run.

If you have access to an EDR, consider submitting a PR to rank its capabilities!

@Kostastsale
https://t.co/ocLeqgReCv

[Luke Roberts @rookuu_]

Playing with Apple’s latest ESF events took a little bit more work this time around!

I’ve written up a post on exploring the new undocumented socket bind events or ES_EVENT_TYPE_RESERVED_3 and _4.

https://t.co/TUu2UQJqgk

[Patrick Wardle @patrickwardle]

You can now build macOS firewalls/network tools via Endpoint Security - no Network Ext. needed! 🤯

Reversing macOS 24.6’s new ES_EVENT_TYPE_RESERVED_* ES events shows some are network auth/notify hooks

Read: “Building a Firewall…via Endpoint Security!?”
https://t.co/gR4t6dPbbr

[Calum Hall @_calumhall]

Awesome job from the Phorion team on the results of the EDR Telemetry Project 🚀

https://t.co/ZeSxUnXHzc

[Kostas @Kostastsale]

📢🍏 macOS is now part of the EDR Telemetry Project. After three months of focused work, we’re excited to share a new framework and generator for endpoint visibility on macOS!

Huge thank you to everyone who contributed and helped shape this release. Looking forward to what comes next.

Read more: https://t.co/qxDGMMsrlH

[Watch This Space @wtsdev]

Electron 41 is out!

It includes a new security feature I contributed and the team let me write a blurb in their announcement blog post! Shoutout and thanks to the team for working with me on this! I'm really enjoying contributing to Electron.

https://t.co/A8Bo2YFOY9

[xiu @osint_barbie]

1/ Oh 🙊, here we go again!

Signed MacSync stealer dropper being delivered via zkcall[.]pro - a fully vibe-coded "secure messenger" for $199/month Premium tier.
Same fake app was documented by @txhaflaire in his MacSync write-up: https://t.co/PQzHKiuBwx

[sysop_host @sysop_host]

Nothing new here, just feels like a feature that’s ripe for abuse for initial access
https://t.co/ntgDSPwtCt

[L0Psec @L0Psec]

Here is an interesting one shared by @malwrhunterteam: f66645abf456e3f67fbcbeb78244c73735541ec2e6fd2e56cf2647823cb0eb99

shell script that downloads a (pretty annoying) obfuscated golang binary. script checks if running on macOS by checking if sw_vers exists, pretty cool.
🧵

[Brian Roemmele @BrianRoemmele]

BOOM!

Apple’s Neural Engine Was Just Cracked Open, The Future of AI Training Just Change And Zero-Human Company Is Already Testing It!

In a jaw-dropping open-source breakthrough, a lone developer has done what Apple said was impossible: full neural network training– including backpropagation – directly on the Apple Neural Engine (ANE). No CoreML, no Metal, no GPU. Pure, blazing ANE silicon.

The project (https://t.co/jrk67hf9p1) delivers a single transformer layer (dim=768, seq=512) in just 9.3 ms per step at 1.78 TFLOPS sustained with only 11.2% ANE utilization on an M4 chip. That’s the same idle chip sitting in millions of Mac minis, MacBooks, and iMacs right now.

Translation? Your desktop just became a hyper-efficient AI supercomputer.

The numbers are insane: M4 ANE hits roughly 6.6 TFLOPS per watt – 80 times more efficient than an NVIDIA A100. Real-world throughput crushes Apple’s own “38 TOPS” marketing claims. And because it sips power like a phone, you can train 24/7 without melting your electricity bill or the planet.

At The Zero-Human Company, we’re not waiting. We are testing this right now on real ZHC workloads. This is the missing piece we’ve been chasing for our Zero Human Company vision: reviving archived data into fully autonomous AI systems with zero human overhead.

This is world-changing.

For the first time, anyone with a Mac can fine-tune, train, or iterate massive models locally, privately, and at a fraction of the cost of cloud GPUs.

No more renting $40,000 A100 clusters. No more waiting in queues. No more massive carbon footprints.

Training costs that used to run into the tens or hundreds of thousands of dollars? Plummeting toward pennies on the dollar – mostly just the electricity your Mac was already using while it sat idle.

The AI revolution just moved from billion-dollar data centers to your desk.

WE WILL HAVE A NEW ZERO-HUMAN COMPANY @ HOME wage for equipped Macs that will be up to 100x more income for the owner!

We’re only at the beginning (single-layer today, full models tomorrow), but the door is wide open. Ultra-cheap, on-device training is here.

The future isn’t coming. It’s already running on your Mac.

Welcome to the Zero-Human Company era.

[Pepe Berba @__pberba__]

I built a tool to monitor Apple Events on macOS.

It surfaces abuse of tools like osascript and helps detect techniques like fake password prompts, even when "display dialog" never appears on the command line.

[L0Psec @L0Psec]

For the last decade, @patrickwardle has released a yearly blog post covering the most notable macOS malware. I'm a big fan and have learned so much from these so I decided to record a few videos using it as a learning resource. Here's part 1:
https://t.co/2UoAIJUeDW

[sysop_host @sysop_host]

Some quick thoughts on abusing tasks in VS Code and how you might detect/mitigate the behaviour.
https://t.co/9A5FiP4Cuy

Hat tip to https://t.co/yZgSwboHHT for the original research and @__pberba__ for the idea sharing.

[sysop_host @sysop_host]

@mattjay I have a trusty bootstrap script to turn on all the sane off-by-default options like right click, install brew, run brew bundle install and setup the dock and a bunch of other stuff how I like it. Iterm config lives in iCloud Drive because I’m lost without my terminal setup.