@objective_see

🍎 🛡️ 🛠️ Open-Source Tools 📚 "The Art of Mac Malware" books 🫂 "Objective by the Sea" conference Support us on https://xitter.cf/t.co/tuGceSeyiC 🙏

 Maui, Hawaii
objective-see.org
Joined October 2011
  • Tweets5.2K
  • Following2
  • Followers19.6K
658Media
Objective-See Foundation retweeted
Patrick Wardle
@patrickwardleOct 15
Neat ChatGPT bug 🐛 Found manually (even after @OpenAI “pointed Astra at its own systems until it ran out of bugs") Local (unpriv'd) attacker: • Hijack your Dot • Take over your account • Access protected macOS files +more 👀 @OpenAI's $500 bounty donated to @objective_see
4
17
94
5,866
Objective-See Foundation retweeted
Patrick Wardle
@patrickwardleOct 5
TaskExplorer now natively integrates with Ollama 🤖 ...so you can bring your favorite local LLM to the party! Latest version available here: objective-see.org/products/t…
Patrick Wardle
@patrickwardleSep 16
I've just (re)written TaskExplorer Think Process Monitor but for macOS, open source, & much more powerful 💪🏽 Highlights: • CLI + JSON export • On-device AI assistant • Code signing + VirusTotal context • Live process/file/dylib/network activity objective-see.com/products/t…
3
12
1
56
4,977
Objective-See Foundation retweeted
Patrick Wardle
@patrickwardleOct 4
security? privacy? 😬
Alexandr Wang
@alexandr_wangOct 4
what we've shipped: muse ♥️ ton of connectors 🔧 muse invite codes 💌 muse phone call beta ☎️ muse for mac  muse in canada 🇨🇦 muse connector platform 🛠️ muse mac computer use 💻 muse for small business 💼 muse gadgets 🕹️ muse memes 🤡 no butthole 🍰 what should we ship next?
3
6
1
59
5,718
Objective-See Foundation retweeted
Jamf
@JamfSoftwareOct 2
A fake Zoom installer found by #JamfThreatLabs hides a stolen macOS password inside a config file using invisible Unicode characters. CloudSyncD uses that password once to launch a backdoor with elevated access. okt.to/SHA3m2 #CybersecurityAwarenessMonth

CloudSyncD: macOS backdoor hidden in a fake Zoom installer

Jamf Threat Labs analyzes CloudSyncD, a fake Zoom installer that phishes the Mac login password, hides it in zero-width Unicode and launches a backdoor.

jamf.com
3
7
1,555
Objective-See Foundation retweeted
Patrick Wardle
@patrickwardleOct 3
Smart way to limit AI agents! 👏 But, @Apple, please don't make Full Disk Access changes harder for macOS Endpoint Security tools! They (per your design) require FDA plus a special entitlement you only grant after vetting, so please keep them easy for users to install! 🙏
Patrick Wardle
@patrickwardleOct 2
Apple is already understandably annoyed by poorly written/insecure/greedy AI agents/assistants insisting on Full Disk Access, and then once granted/obtained, abusing that, to access <all the things>. ...that didn't take long!
6
2
54
4,497
Objective-See Foundation retweeted
Patrick Wardle
@patrickwardleOct 2
But its not secure 😩 Exhibit A: prompt injection (via local attack against ChatGPT)
Sam Altman
@samaOct 2
dot is my favorite openai product so far! it is amazing to me that each day it feels noticably better as it learns more of my workflow and style. having it do the stuff i don't like doing--and usually just builds up as a gravity well of dread--has me very happy.
6
1
47
8,578
Objective-See Foundation retweeted
Alex Kleber a.k.a Privacy 1st
@privacyis1stOct 2
⚠️ Potential scam / impersonation concern: this Mac App Store app uses an icon that closely resembles OpenAI’s official ChatGPT icon. @Apple is obsolete to fight with scams.... @OpenAI @AppleSupport apps.apple.com/us/app/ai-cha…
2
1
3
12
3,944
Objective-See Foundation retweeted
Arin
@arinwaichulisOct 2
Wild. I've written about clones like this multiple times and Apple sees it and pulls them no problem. But I still have no idea how they keep getting through the review process. This one is currently #2 in education on the Mac App Store 😖
Alex Kleber a.k.a Privacy 1st
@privacyis1stOct 2
⚠️ Potential scam / impersonation concern: this Mac App Store app uses an icon that closely resembles OpenAI’s official ChatGPT icon. @Apple is obsolete to fight with scams.... @OpenAI @AppleSupport apps.apple.com/us/app/ai-cha…
2
1
13
1,452
Objective-See Foundation retweeted
Pacific NW Computers
@PacificNWComputOct 2
If you are a Mac OSX user, check out @objective_see !! They are a non-profit foundation focused on macOS security, driven by the mission to create free tools, grow and support a global community and advance Apple security through education, research, collaboration, and opportunity!! objective-see.org/tools.html

Objective-See: Tools

Free, open-source tools to protect your Mac

objective-see.org
3
5
492
Objective-See Foundation retweeted
Calif
@calif_ioSep 30
CVE-2026-86950: The Great Glyph Grift calif.io/research/the-great-…
4
79
7
249
56,059
Objective-See Foundation retweeted
Csaba Fitzl
@theevilbitOct 2
🍎🐛 I got Claude making this, maybe it's useful for others as well. Every Apple security advisory since 2002 - parsed, indexed, charted. With links to writeups, POCs and presentations. apple-cve.com/

APPLE·CVE — every Apple security advisory, indexed

Search, filter and chart every CVE in Apple's security release notes since 2002.

apple-cve.com
13
54
5
296
25,497
Objective-See Foundation retweeted
Virus Bulletin@virusbtnSep 23
MacOS credentials are under fire from PAMStealer (Wavel), a new infostealer using PAM-based credential validation. Jamf caught it using a server-side key exchange that prevents static payload recovery. jamf.com/blog/pamstealer-wav…
10
23
2,222
Objective-See Foundation retweeted
L0Psec@L0PsecSep 22
Another interesting share from @malwrhunterteam. This time we have a revoked signature app which eventually appears to lead to an infostealer: 7ec35de2f6ca3a0fd9f6b51b79040c778e0e3a8c81ba2f8d7d259d1078c78e8e - daynote Team ID: OSMAN ASTUR (8T6UCTT38A) 🧵
3
6
1
25
10,261
Objective-See Foundation retweeted
Csaba Fitzl
@theevilbitSep 23
🍎🐛 Found my second Notarization/GateKeeper bug. I can get something stamped and then modify contents and still accepted by the system. 🙈 Remember: Everything that was notarized was checked for malware by Apple... unless you can modify content as you wish. 🤷‍♂️
5
3
1
53
7,498
Objective-See Foundation retweeted
Moonlock Lab
@moonlock_labSep 22
New #Mac #stealer in the wild: Sonoma. Crazy Evil's 2026 kit. Same crew we wrote about in 2024. Impersonated brands we saw so far: StreamYard, Zoom, Slack, DocSend, Brave Talk, Toria, Waaako, Meendo, CavePay, Crystal Flip, Cốc Cốc. Some fun facts: - one chain fetched the next stage from Apple Calendar. - the first loaders still used /tmp/osalogging.zip. That's a MacSync leftover. They borrowed pieces. - it talks to PAM, so it looked like Avenger (PamStealer), but it isn't Read more: hackernoon.com/downloading-z…

Downloading Zoom or Brave? Could Be New Mac Malware ‘Sonoma’ In Disguise | HackerNoon

New macOS stealer Sonoma hides in fake StreamYard, Zoom, Slack, and DocSend installers, then steals passwords, browser data, and crypto wallets.

hackernoon.com
12
37
3,037
Objective-See Foundation retweeted
slinafirinne
@slinafirinneSep 24
I finally got around to the writeup for my 2nd $20,000 bounty from @Apple here: github.com/petermalone/CVE-2… @gergely_kalman I know you had specifically asked for this so here you go. I learned so much playing around with this. I'll document the first later this week. Enjoy! Thanks again to @Apple - the bounty announcement took just 11 days for this one. Crazy.

GitHub - petermalone/CVE-2026-84543: Technical disclosure and PoC for CVE-2026-84543, a macOS SMB...

Technical disclosure and PoC for CVE-2026-84543, a macOS SMB kernel vulnerability - petermalone/CVE-2026-84543

github.com
slinafirinne
@slinafirinneMay 15
Thanks again Apple for another accelerated bug bounty payment. 🎯🎯
6
51
528
31,182
Objective-See Foundation retweeted
John Dagdelen
@jmdagdelenSep 23
Zuck: “introducing Muse, your personal superintelligence in a secure. private, personal VM.” Alexander Wang: “So I’ve been watching what people do with their muses and here are some examples.”
116
190
38
7,410
918,067
Objective-See Foundation retweeted
L0Psec@L0PsecSep 17
Excited to talk about the continued evolution of macOS threats at the upcoming cyber session! :)
Volexity
@VolexitySep 17
As macOS adoption grows in the enterprise, so does attacker interest. @L0Psec will be speaking at our upcoming Volexity Cyber Sessions in Amsterdam (October 29) about the current macOS threat landscape, including the lures, targets, and recently discovered malware families shaping this space. He will walk through commonly observed behaviors and artifacts used to drive disk and memory forensic analysis of a potentially compromised macOS system, and how these findings can be translated into durable detection strategies. Seating is limited. Register now to secure your spot: luma.com/0qtkw49c #macOS #threatintel #dfir
5
42
3,079
Objective-See Foundation retweeted
Patrick Wardle
@patrickwardleSep 15
And protection will only improve when Apple makes the `es_event_paste_t` Endpoint Security event available to 3rd-party security tools!! 🤞🏼 #SharingIsCaring See: objective-see.org/blog/blog_…

No Paste for You!

Reverse Engineering Apple's ClickFix Protections

objective-see.org
Objective-See Foundation@objective_seeSep 15
"ClickFix attacks infecting PCs and Macs are going viral" Nice to see a shoutout for BlockBlock 😍 ...which yes, provides some literal “block block-ing” of these attacks! 🛡️🍎 arstechnica.com/security/202…
4
37
5,530
Objective-See Foundation retweeted
Patrick Wardle
@patrickwardleSep 15
Reminder: 🍎-security tools subscribing to ES AUTH_* events must respond before an ES deadline (~15s) or the kernel kills them ...& they stay ☠️ Privileged attacker? SIGSTOP the tool ...⏳💥😂 Mitigation (per @PeteMarkowsky) subscribe to/block signals! docs.google.com/presentation…
1
4
2
42
10,884
Load more