Phil Stokes ⫍🐠⫎
@philofishal.bsky.social
macOS security researcher espousing no one's opinions but my own. Dogged follower of #lufc, at least until the world stops going round (IYKYK).
philastokes.com
philastokes.com
November 7, 2025 at 6:15 PM
🙌 Updated the XProtect-Malware-Families repo to the latest version of XProtect.
💁♂️ The repo maps #Apple #malware names to more common names used by security vendors.
➕ #YARA style tags so now you can search for classes of malware like 'infostealer', 'trojan'. #security
github.com/SentineLabs/...
💁♂️ The repo maps #Apple #malware names to more common names used by security vendors.
➕ #YARA style tags so now you can search for classes of malware like 'infostealer', 'trojan'. #security
github.com/SentineLabs/...
November 4, 2025 at 5:57 PM
🙌 Updated the XProtect-Malware-Families repo to the latest version of XProtect.
💁♂️ The repo maps #Apple #malware names to more common names used by security vendors.
➕ #YARA style tags so now you can search for classes of malware like 'infostealer', 'trojan'. #security
github.com/SentineLabs/...
💁♂️ The repo maps #Apple #malware names to more common names used by security vendors.
➕ #YARA style tags so now you can search for classes of malware like 'infostealer', 'trojan'. #security
github.com/SentineLabs/...
#Apple's update for #XProtect v5316 includes new rules for #Amos #infostealer. BUT ⚠ XProtect_MACOS_SOMA_SEENC is only detecting bytes in the x86 slice. Thin that binary and you can run the arm slice without detection. #security #macOS
Sample md5: 7f394bdf8f94b7ba9bc6031b5477f556
Sample md5: 7f394bdf8f94b7ba9bc6031b5477f556
September 26, 2025 at 3:43 PM
Why would he be sacked? Leeds sit 12th in the table after three games. Above Manchester City, Newcastle, Fulham and Villa.
September 9, 2025 at 8:50 AM
Why would he be sacked? Leeds sit 12th in the table after three games. Above Manchester City, Newcastle, Fulham and Villa.
August 12, 2025 at 12:42 PM
Power up your #radare2 pifc command with a $pifc alias that sorts and counts the calls in a function. #macOS #reverseengineering #r2
April 1, 2025 at 1:02 PM
Power up your #radare2 pifc command with a $pifc alias that sorts and counts the calls in a function. #macOS #reverseengineering #r2
Up next: second-from-bottom Luton, who have just won and now decided they want to be one of the Champo’s in-form teams - fifth in the league to our miserable 12th. 🙀 #lufc
March 30, 2025 at 12:53 AM
Up next: second-from-bottom Luton, who have just won and now decided they want to be one of the Champo’s in-form teams - fifth in the league to our miserable 12th. 🙀 #lufc
And the fun part is it beacons out to the C2 to let the operator know the device is ready for compromise.
January 20, 2025 at 3:53 PM
And the fun part is it beacons out to the C2 to let the operator know the device is ready for compromise.
This backdoor has the ability to execute remote commands and to take screen captures. It also self signs and attempts to hide its true name from inspection through osascript and System Events.
January 20, 2025 at 3:53 PM
This backdoor has the ability to execute remote commands and to take screen captures. It also self signs and attempts to hide its true name from inspection through osascript and System Events.
That's going to result in a request to install Xcode's (current) command line tools if not already installed.
January 20, 2025 at 3:53 PM
That's going to result in a request to install Xcode's (current) command line tools if not already installed.
This #macOS backdoor uses /usr/bin/SetFile to hide itself in the Finder. SetFile was deprecated in Xcode 6 (that's 2014 to humans)...not sure why it makes sense to declare smth 'deprecated' then leave it in the OS for 10+ years. 🤷♂️ #apple #malware
SHA1: 609088c54b99432aab212f35cfe74030b52f0320
SHA1: 609088c54b99432aab212f35cfe74030b52f0320
January 20, 2025 at 3:53 PM
November 29, 2024 at 2:02 PM
The good old days, when you could open up a #Mac and play with the insides. 😀 #fixit #upgrade #repairability
That old 2009 MBP is still running today, too. 💜
That old 2009 MBP is still running today, too. 💜
November 29, 2024 at 1:44 PM
The good old days, when you could open up a #Mac and play with the insides. 😀 #fixit #upgrade #repairability
That old 2009 MBP is still running today, too. 💜
That old 2009 MBP is still running today, too. 💜
“It’s OK to eat [your enemy] because they don’t have any feelings”.
November 26, 2024 at 2:37 AM
“It’s OK to eat [your enemy] because they don’t have any feelings”.