FAUTLReports

Catching macOS Stealers in the Wild

2026-04-01

Author: Pablo Redondo Castro

file_types:txt file_types:pdf file_types:bin file_types:python file_types:sh file_types:so techniques:sandbox file_types:doc file_types:xls techniques:data theft

No Paste for You!

2026-03-31

Objective-See

Author: Patrick Wardle

file_types:so file_types:bash file_types:c platforms:windows file_types:xml file_types:swift platforms:macos architecture:arm64 debugger:lldb file_types:dylib

Building a Firewall ...via Endpoint Security!?

2026-03-27

Objective-See

Author: Patrick Wardle

file_types:bin file_types:so file_types:go file_types:c platforms:macos

ClickFix: Stopped at ⌘+V

2026-02-15

Objective-See

Author: Patrick Wardle

malware_types:loader file_types:so platforms:windows platforms:macos file_types:zsh file_types:shortcut

The Mac Malware of 2025

2026-01-01

Objective-See

Author: Patrick Wardle

file_types:dll architecture:arm malware_types:loader architecture:x86_64 file_types:python file_types:javascript file_types:mach-o techniques:malware analysis tools file_types:rtf cve:cve-2022-26712

A Remote Pre-Authentication Overflow in LLDB's debugserver

2025-12-07

Objective-See

Author: Nathaniel Oh

file_types:bin debugger:gdb file_types:python file_types:so file_types:cpp platforms:macos platforms:ios debugger:lldb file_types:fish cve:cve-2025-43504

Restoring Reflective Code Loading on macOS (Part II)

2025-11-24

Objective-See

Author: Patrick Wardle

file_types:bin malware_types:loader file_types:so file_types:c file_types:swift platforms:macos file_types:mach-o file_types:dylib file_types:objective-c

Unmasking KorPlug: A Technical Breakdown - Part 2

2025-08-19

RevEng.AI

file_types:dll architecture:x86 file_types:pe malware_types:loader file_types:python file_types:c platforms:windows techniques:obfuscation techniques:side-loading techniques:code obfuscation

Unmasking KorPlug: A Technical Breakdown

2025-06-24

RevEng.AI

file_types:dll malware_types:rat file_types:dat file_types:pe file_types:exe malware_types:loader malware_types:trojan platforms:windows file_types:msi techniques:side-loading

Automating String Decoding in Malware: Analysing StealC V1 with IDAPython

2025-06-04

RevEng.AI

file_types:python file_types:elf file_types:so file_types:c techniques:encryption techniques:obfuscation techniques:anti-analysis techniques:string obfuscation debugger:pdb

Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows

2025-04-22

VOLEXITY

Author: Charlie Gardner, Josh Duke, Matthew Meltzer, Sean Koessel, Steven Adair, Tom Lancaster

techniques:phishing cloud_environments:azure

TCCing is Believing! Apple finally adds TCC events to Endpoint Security!

2025-03-27

Objective-See

Author: Patrick Wardle

file_types:so file_types:c platforms:macos file_types:objective-c

[0day] From Spotlight to Apple Intelligence

2025-03-27

Objective-See

Author: Patrick Wardle

file_types:so techniques:persistence techniques:sandbox platforms:macos cve:cve-2024-54533 cve:cve-2025-31199

Leaking Passwords (and more!) on macOS

2025-03-20

Objective-See

Author: Noah Gregory

malware_types:ransomware techniques:system calls file_types:so file_types:macho malware_types:backdoor techniques:privilege escalation platforms:macos platforms:ios cve:cve-2024-5447 cve:cve-2024-54471

LummaStealer: More Tricks, More Trouble - Part 2

2025-03-05

RevEng.AI

file_types:dll file_types:zip file_types:txt techniques:phishing file_types:powershell file_types:exe file_types:html architecture:x64 techniques:obfuscation techniques:anti-analysis

Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication

2025-02-13

VOLEXITY

Author: Charlie Gardner, Steven Adair, Tom Lancaster

techniques:phishing

One ClickFix and LummaStealer reCAPTCHA’s Our Attention - Part 1

2025-01-30

RevEng.AI

file_types:dll techniques:phishing file_types:powershell malware_types:loader file_types:html file_types:python malware_types:virus file_types:javascript techniques:sandbox file_types:iso

The Mac Malware of 2024

2025-01-01

Objective-See

Author: Patrick Wardle

malware_types:ransomware file_types:rar architecture:arm malware_types:loader architecture:x86_64 file_types:python file_types:javascript file_types:mach-o techniques:malware analysis tools file_types:rtf

Restoring Reflective Code Loading on macOS

2024-12-16

Objective-See

Author: Patrick Wardle

malware_types:fileless malware_types:loader file_types:so file_types:go techniques:encryption platforms:windows file_types:cpp platforms:macos file_types:mach-o file_types:dylib

AI Models for Decompiling Assembly Code

2024-11-16

RevEng.AI

file_types:so file_types:go file_types:c platforms:windows disassembler:ida pro disassembler:ghidra

Malware Analysis Reports