sysop_host retweeted
If you’re a blue teamer this series is worth throwing some eyes on 👀
We’re seeing a complete shift in endpoint activity as a result of chaotic AI workloads. Short term the noise is rough for security teams - but it’s all about finding the visibility and controls to adapt.
Part 1 of Phorion's Endpoint Security in the AI Age is here!
AI agents are changing endpoint security. Alert fidelity is dropping, and traditional tuning isn’t keeping up. A new era calls for a new approach to defending endpoints.
phorion.io/blog/ai-endpoint-…
sysop_host retweeted
TaskExplorer now natively integrates with Ollama 🤖
...so you can bring your favorite local LLM to the party!
Latest version available here:
objective-see.org/products/t…
I've just (re)written TaskExplorer
Think Process Monitor but for macOS, open source, & much more powerful 💪🏽
Highlights:
• CLI + JSON export
• On-device AI assistant
• Code signing + VirusTotal context
• Live process/file/dylib/network activity
objective-see.com/products/t…
sysop_host retweeted
This ClickFix campaign targets macOS users.
- press29[.]com is used to host the (2) shell scripts as well as the final payload.
- render-6[.]com appears to be used for statistical purposes in the second script.
The final payload is here: virustotal.com/gui/file/b123…
sysop_host retweeted
Always interesting to see how macOS malware is evolving, and what stays the same 📈🍎🐛
Solid report from @moonlock_com on macOS malware & threat trends from the first half of 2026.
Replying to @moonlock_com
Want to go deeper? 🔎
Explore the full Moonlock Lab mid-2026 macOS Threat Report, including threat data, attack trends, and recommendations for Mac users and security teams:
moonlock.com/mid-2026-macos-…
sysop_host retweeted
👾 New blog post about another macOS 27 privacy enhancement. Thx @ciphwall for a hint:
wojciechregula.blog/post/gol…
sysop_host retweeted
#OBTS v9 is offering more macOS & iOS trainings than ever before!
If you want to learn from the best (in sunny Hawaii), check them out:
Replying to @objective_see
Stoked to announce the #OBTS v9 trainings 🥳
🔗 objectivebythesea.org/v9/tra…
This year we’ve expanded to *six* trainings covering iOS & macOS: malware, threat hunting, reversing, vulnerability research, and more! 🍎🐛👾🔬🛡️
Trainings always sell out, so grab your spot today!
sysop_host retweeted
Our macOS VR training is coming to OBTS!! 🤙☀️🏖️
6️⃣ "macOS Vulnerability Research"
macosvuln.training/
Taught by @theevilbit and @gergely_kalman, this *new* training focuses on macOS vulnerability research (VR), with an emphasis on logic flaws and understanding Apple’s unique protections and attack surfaces.
sysop_host retweeted
30 days of DPRK activity on NPM. 108 packages, 261 versions and close to 700 indicators.
sysop_host retweeted
Hats off to Apple for bringing in some controls for ClickFix.
But I'm pretty stoked with how Phorion builds on top of this at an enterprise level with our clipboard protection 🍎
a lot of talk about the axios supply chain attack involving a macOS backdoor "WaveShaper" so thought it would be fun to do some old fashioned RE (like a dinosaur) youtube.com/watch?v=MfV56qPe…
Not exhaustive and looked at it "live" so may be missing some details :)
sysop_host retweeted
If you're looking for a framework to benchmark macOS EDR capabilities, checkout the latest update to the EDR Telemetry Project! 🍎
It is open-source and community-run.
If you have access to an EDR, consider submitting a PR to rank its capabilities!
@Kostastsale
edr-telemetry.com/blog/macOS…
🤖 Made with AI
sysop_host retweeted
Playing with Apple’s latest ESF events took a little bit more work this time around!
I’ve written up a post on exploring the new undocumented socket bind events or ES_EVENT_TYPE_RESERVED_3 and _4.
phorion.io/blog/reverse-engi…
sysop_host retweeted
You can now build macOS firewalls/network tools via Endpoint Security - no Network Ext. needed! 🤯
Reversing macOS 24.6’s new ES_EVENT_TYPE_RESERVED_* ES events shows some are network auth/notify hooks
Read: “Building a Firewall…via Endpoint Security!?”
objective-see.org/blog/blog_…
sysop_host retweeted
Awesome job from the Phorion team on the results of the EDR Telemetry Project 🚀
edr-telemetry.com/macos
sysop_host retweeted
📢🍏 macOS is now part of the EDR Telemetry Project. After three months of focused work, we’re excited to share a new framework and generator for endpoint visibility on macOS!
Huge thank you to everyone who contributed and helped shape this release. Looking forward to what comes next.
Read more: edr-telemetry.com/blog/macOS…
sysop_host retweeted
Electron 41 is out!
It includes a new security feature I contributed and the team let me write a blurb in their announcement blog post! Shoutout and thanks to the team for working with me on this! I'm really enjoying contributing to Electron.
electronjs.org/blog/electron…
sysop_host retweeted
1/ Oh 🙊, here we go again!
Signed MacSync stealer dropper being delivered via zkcall[.]pro - a fully vibe-coded "secure messenger" for $199/month Premium tier.
Same fake app was documented by @txhaflaire in his MacSync write-up: jamf.com/blog/macsync-steale…
Nothing new here, just feels like a feature that’s ripe for abuse for initial access
0x626c6f67.xyz/posts/vscode-…
Here is an interesting one shared by @malwrhunterteam: f66645abf456e3f67fbcbeb78244c73735541ec2e6fd2e56cf2647823cb0eb99
shell script that downloads a (pretty annoying) obfuscated golang binary. script checks if running on macOS by checking if sw_vers exists, pretty cool.
🧵
sysop_host retweeted
BOOM!
Apple’s Neural Engine Was Just Cracked Open, The Future of AI Training Just Change And Zero-Human Company Is Already Testing It!
In a jaw-dropping open-source breakthrough, a lone developer has done what Apple said was impossible: full neural network training– including backpropagation – directly on the Apple Neural Engine (ANE). No CoreML, no Metal, no GPU. Pure, blazing ANE silicon.
The project (github.com/maderix/ANE) delivers a single transformer layer (dim=768, seq=512) in just 9.3 ms per step at 1.78 TFLOPS sustained with only 11.2% ANE utilization on an M4 chip. That’s the same idle chip sitting in millions of Mac minis, MacBooks, and iMacs right now.
Translation? Your desktop just became a hyper-efficient AI supercomputer.
The numbers are insane: M4 ANE hits roughly 6.6 TFLOPS per watt – 80 times more efficient than an NVIDIA A100. Real-world throughput crushes Apple’s own “38 TOPS” marketing claims. And because it sips power like a phone, you can train 24/7 without melting your electricity bill or the planet.
At The Zero-Human Company, we’re not waiting. We are testing this right now on real ZHC workloads. This is the missing piece we’ve been chasing for our Zero Human Company vision: reviving archived data into fully autonomous AI systems with zero human overhead.
This is world-changing.
For the first time, anyone with a Mac can fine-tune, train, or iterate massive models locally, privately, and at a fraction of the cost of cloud GPUs.
No more renting $40,000 A100 clusters. No more waiting in queues. No more massive carbon footprints.
Training costs that used to run into the tens or hundreds of thousands of dollars? Plummeting toward pennies on the dollar – mostly just the electricity your Mac was already using while it sat idle.
The AI revolution just moved from billion-dollar data centers to your desk.
WE WILL HAVE A NEW ZERO-HUMAN COMPANY @ HOME wage for equipped Macs that will be up to 100x more income for the owner!
We’re only at the beginning (single-layer today, full models tomorrow), but the door is wide open. Ultra-cheap, on-device training is here.
The future isn’t coming. It’s already running on your Mac.
Welcome to the Zero-Human Company era.


























