malware and kittens, basically. she/her

Joined September 2009
#OBTS v9 schedule is LIVE! 🔥 objectivebythesea.org/v9/sch… If you're into Apple security (yes, including securing those pesky AI agents 🤖), you seriously don't want to miss this one! Hope to see you by the sea ☀️🌊
1
9
26
2,362
And once a Mac is exploited, you can interact with any of the users "connected" devices also running Muse. ...meaning you remotely task their mobile (iOS) Muse client ...invisibly 📲🔓👀 What can you do? Welll, some very neat iOS stuff!
Please don't install - it's trivial to turn Muse into the ultimate backdoor 💀👀 Ya, as an AI assistant built to manage your Mac, Muse needs broad access to your digital life. But serious 0-day flaw(s) can let local malware/attackers invisibly hijack it. Let me show you. 🧵
12
51
15
333
284,135
As I was writing Day 4 content about a sandbox escape vulnerability, I added a whole section about GateKeeper internals as well. Interested in finding that 100k$ GK bypass vulnerability? Join our training and understand the basics so you know how to get started! Only in Budapest this year.
Our next training with @gergely_kalman will be in Budapest between the 12th and 15th of October. This is our only training in Europe for this year, and this is the only time we will teach the 4 day version of the training. If you are looking getting into Apple vuln research then this is Your training. Although we don't do iOS here, many of the concepts we teach are applicable there as well. macosvuln.training/
1
3
22
3,625
Lorenzo has always been solid, professional, and loves telling stories from an accurate perspective with the correct details. Highly recommend for any fellow hackers, tech, and related fields. Wishing you the best always
~ Personal news ~ I left TechCrunch. I will now focus on finishing my book about Hacking Team and the history of government spyware. After that, and in the meantime, I will be freelancing. Contact me: [email protected] or Signal @ LorenzoFB.1337 (+1 917 257 1382)
7
42
3,180
I've just (re)written TaskExplorer Think Process Monitor but for macOS, open source, & much more powerful 💪🏽 Highlights: • CLI + JSON export • On-device AI assistant • Code signing + VirusTotal context • Live process/file/dylib/network activity objective-see.com/products/t…
10
50
7
347
31,282
Erika Noerenberg [email protected] retweeted
fashion 1.2.0 is out 🎉 macOS 27 adds a third slice to every system binary, arm64e.x1. fashion now names slices exactly as codesign does, so nothing hides behind a plain arm64. Hash, match and triage Mach-O: SHA-2, ssdeep, TLSH, CDHash, symhash. codeberg.org/melomac/fashion…
5
13
715
Was stoked to talk nerdy with @arinwaichulis & Kseniia (@osint_barbie) about the ever-changing macOS threat landscape, Apple’s bug bounty changes, #OBTS v9, and more 🍎🤓 Have a listen!
3
19
3,793
This is an an excellent lineup of talks, and I'm honored to present again, along with @gergely_kalman . We will hack macOS like it's the 80s! This will be my 7th OBTS talk, can't believe time flies so fast. My favorite conference, small, awesome speakers, people, great community, great chats for 3 days, can't wait to be back ❤️
Just announced: talks for #OBTS v9 🥳 Stoked on an epic lineup of cutting-edge 🍎- security research, covering exploitation, malware, reversing, security tools, AI, & more! Check out the full lineup: objectivebythesea.org/v9/tal… Which one(s) are you most looking forward to!? 🤔
2
9
33
3,693
Just announced: talks for #OBTS v9 🥳 Stoked on an epic lineup of cutting-edge 🍎- security research, covering exploitation, malware, reversing, security tools, AI, & more! Check out the full lineup: objectivebythesea.org/v9/tal… Which one(s) are you most looking forward to!? 🤔
3
16
9
53
24,789
The latest macOS ClickFix variant invisibly mounts DMG images in the background to execute a macOS infostealer and hijack cryptocurrency wallet info. Details at bit.ly/4ahgmhJ
5
31
3
157
14,980
3️⃣ "Practical iOS Reverse Engineering" reversing.training/obtsv9/ Join @naehrdine for this hands-on training covering iOS app reversing, Frida, Ghidra/IDA, XPC, kernel & firmware internals, & the latest iOS security mitigations. From beginner fundamentals to advanced iOS internals
1
3
21
1,266
Our macOS VR training is coming to OBTS!! 🤙☀️🏖️
6️⃣ "macOS Vulnerability Research" macosvuln.training/ Taught by @theevilbit and @gergely_kalman, this *new* training focuses on macOS vulnerability research (VR), with an emphasis on logic flaws and understanding Apple’s unique protections and attack surfaces.
7
35
5,699
The 2025 @volatility #PluginContest review is complete! We received 8 submissions from 7 different countries that included 20 plugins! We will be highlighting each #Contender & the winners will be announced on Friday! #DFIR #memoryforensics
9
7
1
13
13,606
It will be epic :)
#Zer0Con2026 - SPEAKER 💾 Csaba Fitzl(@theevilbit) & Gergely Kalman(@gergely_kalman) - “macOS Exploit Mixtape - Hack Like it’s the 80s” For more: zer0con.org
2
7
1,522
Erika Noerenberg [email protected] retweeted
🧵 1/ What a funny story how @g0njxa and I decided to start trading and download TradingView Premium for FREE! (freaking AI is gonna replace us, so...) xD Check this macOS stealer campaign that is using @Reddit karma-farming, allegedly compromised Indian tech company as a redirect, and a ClickFix trick to deliver the SHub Stealer that steals sensitive data, trojans your crypto wallets, and tries to persist disguised as Google Updater. But don't worry - if you have a Russian keyboard, it won't touch you :3
3
11
1
47
9,294
Motivated by @moonlock_lab’s recent findings on ClickFix attacks surfacing via Google Search results and even LLMs 🤯, I’ve added basic protection against most of these attacks to BlockBlock 🍎🛡️ Read: “ClickFix: Stopped at ⌘+V” objective-see.org/blog/blog_…
1
19
2
81
9,432
A Christmas Miracle? The tiny piece of jewelry was so small it was easy to miss. It’s a small, silver ring, but engraved inside is the wedding date of June 6, 1953, and the couple’s initials. That would be 72 years of marriage this year. An amazing and loving story told in one part by this traditional symbol. We think it means a lot to that couple and we’d like to return it to them if possible so we’re asking for our community’s help. It was found in the Gondolier restaurant parking lot off of Baseline and Foothills on Nov. 8 by a community member who tried in vain to find its owners via social media. Having no luck she turned it in to us on Nov. 17. You can see it here. If anyone has any information about who this ring belongs to, we ask you to contact our Property and Evidence Unit by calling 303-441-3340. You will have to provide proof the ring belongs to you. We’re hoping for a Christmas miracle. Can you help us make it happen Boulder?
1
14
54
7,030
Recon recon.cx/2026/en/index.html Conference: June 19 to 21 2026. More announcements coming soon.
3
18
1
60
7,043
Join us for another interview this Friday at 4pm ET with Tim Blazytko! As the instructor of Software Deobfuscation Techniques at RE//verse 2026, we'll be picking his brain about the role obfuscation and deobfuscation play a role in today's cybersecurity scene. What would you like to know? Reply with your questions! youtube.com/live/GQtX7S_oXbY
3
7
1
27
10,153