In this episode of Behind the Binary, we sit down with Mac security researcher Christopher Lopez (L0psec). to discuss the evolving landscape of macOS malware. As Mac adoption continues to grow in enterprise environments and among developers, threat actors are increasingly targeting the platform.
Chris breaks down current attack vectors, starting with the rise of social engineering tactics like ClickFix, fake software downloads, and malvertising campaigns. They explore how infostealer families like Atomic Stealer (AMOS) and persistent backdoor threats have matured, transitioning from simple cleartext scripts to complex, multi-layered obfuscation, C2 fail-safes, and anti-analysis checks. The conversation also covers DPRK APT campaigns targeting developers through fake job interviews and compromised VS Code environments.
Finally, Josh and Chris discuss the impact of AI and LLM-driven workflows on the reverse engineering discipline. They dive into the balance between automated code deobfuscation, rapid detection engineering, and the loss of traditional manual reversing workflows as the industry shifts toward reversing at scale.
Key Topics Covered:
Enterprise macOS adoption and the expanding threat surface
Initial access vectors: ClickFix, malvertising, and Terminal social engineering
Evolution of Mac InfoStealers (AMOS/Atomic Stealer, MacSync) and persistence
Advanced threats: DPRK developer targeting via VS Code tasks
Podden och tillhörande omslagsbild på den här sidan tillhör
Josh Stroschein. Innehållet i podden är skapat av Josh Stroschein och inte av,
eller tillsammans med, Poddtoppen.
