In this episode of Behind the Binary, we sit down with Mac security researcher Christopher Lopez (L0psec). to discuss the evolving landscape of macOS malware. As Mac adoption continues to grow in enterprise environments and among developers, threat actors are increasingly targeting the platform.

Chris breaks down current attack vectors, starting with the rise of social engineering tactics like ClickFix, fake software downloads, and malvertising campaigns. They explore how infostealer families like Atomic Stealer (AMOS) and persistent backdoor threats have matured, transitioning from simple cleartext scripts to complex, multi-layered obfuscation, C2 fail-safes, and anti-analysis checks. The conversation also covers DPRK APT campaigns targeting developers through fake job interviews and compromised VS Code environments.

Finally, Josh and Chris discuss the impact of AI and LLM-driven workflows on the reverse engineering discipline. They dive into the balance between automated code deobfuscation, rapid detection engineering, and the loss of traditional manual reversing workflows as the industry shifts toward reversing at scale.

Key Topics Covered:

• Enterprise macOS adoption and the expanding threat surface
• Initial access vectors: ClickFix, malvertising, and Terminal social engineering
• Evolution of Mac InfoStealers (AMOS/Atomic Stealer, MacSync) and persistence
• Advanced threats: DPRK developer targeting via VS Code tasks
• Obfuscation trends: Dynamic AES encryption, C2 key retrieval, and external fail-safe C2s
• AI's dual role in malware development and reverse engineering workflows
• System protections: TCC, SIP, Endpoint Security (ES) APIs, and macOS security prompts

Join the Community

• Research Hub: Threat research, training events and news:
  https://cloud.google.com/security/flare
• The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com

FOLLOW THE SHOW:

• Subscribe: Apple Podcasts | Spotify | YouTube

"Throwing more LLM prompts at a packed binary won’t make your analysis faster. But combining code similarity with AI will."

In Episode 29 of Behind the Binary, Jonas Wagner and Endre Bangerter of ThreatRay join the podcast to lay out the real-world state of binary similarity in the LLM era. They demystify the current AI hype cycle, explaining why large language models are structurally unsuited for raw, unguided binary analysis, and how traditional binary similarity techniques are finding a massive resurgence as the ultimate intelligence pre-filter.

Learn how they automate the classification of complex compiled samples by separating known-good libraries from unique malware code, and how these combined workflows are shrinking threat attribution timelines down from days to minutes.

THE SESSION:

• Beyond BinDiff: Tracing the transition from expert-crafted syntactic tools to deep semantic vector matching.
• The Token-Saver Pipeline: How to stop wasting LLM context windows on standard library runtimes (like Go and Rust) and target only custom, unique malware functions.
• Dynamic Unpacking: Leveraging sandbox execution and memory dumps to capture clean binary representations before static analysis begins.
• Anti-AI Obfuscation: The emerging landscape of adversarial techniques designed to throw off both similarity algorithms and LLMs.
• Scale and Attribution: Building indexed code repositories to search back in time and attribute code reuse across decades of malware families.

Join the Community

• Research Hub: Threat research, training events and news:
  https://cloud.google.com/security/flare
• The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com

FOLLOW THE SHOW:

• Subscribe: Apple Podcasts | Spotify | YouTube

In this episode, we're joined by security researcher Olivia Gallucci to explore macOS low-level security, kernel exploitation, and macOS threat trends. We break down how macOS internals differ from Linux—focusing on IOKit, C++ dynamic class resolution, and Vtable hijacking in kernel drivers. Olivia explains the mechanics behind use-after-free (UAF) vulnerabilities, heap shaping, and legacy kernel exploits, as well as modern Apple hardware and OS defenses like Pointer Authentication Codes (PAC) and kalloc type isolation (PAC IA/DA semantics).

We also discuss the evolution of macOS threat research, the rise of macOS info stealers driven by cryptocurrency targeting, local detection telemetry using Endpoint Security (ES) and tools like Mac Monitor, and the current dynamics of vulnerability research and bug bounty programs.

Key Discussion Points:

• Mac vs. Linux Internals: Why macOS isn't "just Linux," and how IOKit’s C++ driver framework creates unique attack surface.
• Vtable Hijacking & Kernel Exploits: How dynamic method resolution and C++ polymorphism are targeted using UAF, out-of-bounds writes, and heap shaping.
• Modern Defenses: How Apple leverages Pointer Authentication Codes (PAC IA/DA) and type-isolated heap allocators to disrupt traditional exploit primitives.
• The Rise of macOS Infostealers: What drove the surge in macOS stealer malware, their simple architecture, and social engineering delivery tactics.
• Detection & Telemetry: Monitoring local exploit failures, kernel panics, and process events via Endpoint Security (ES Logger) and open-source tools like Mac Monitor.
• Vulnerability Research Ecosystem: The role of AI in technical research, shifting bug bounty payouts, and the dynamics between vendor programs and third-party research.

Resources mentioned:

• Olivia Gallucci's Blog: oliviagallucci.com
• Mac Monitor by Brandon Dalton: https://github.com/Brandon7CC/mac-monitor

Join the Community

• Research Hub: Threat research, training events and news:
  https://cloud.google.com/security/flare
• The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com

FOLLOW THE SHOW:

• Subscribe: Apple Podcasts | Spotify | YouTube