Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Patrick Wardle
Objective-See's Blog
No Paste for You! Reverse Engineering Apple's ClickFix Protections The Objective-See Foundation is supported by: ClickFix has quickly become a widely adopted infection technique targeting both macOS and Windows users. Rather than relying on software vulnerabilities or exploit chains, it leverages something much simpler: convincing a user to copy and paste a command into a terminal.
Building a Firewall ...via Endpoint Security!?
Building a Firewall ...via Endpoint Security!? Reverse Engineering macOS 26.4's Undocumented Network Events The Objective-See Foundation is supported by: Special thanks to Luke from Phorion for his input/ideas! Each release of macOS brings a host of security fixes, but also the occasional new Endpoint Security events. Such events can extend and improve security tools that already leverage Endpoint Security. Endpoint Security events can be found in ESTypes.h in a large es_event_type_t enum.
ClickFix: Stopped at ⌘+V
ClickFix: Stopped at ⌘+V Defending against malicious terminal pastes The Objective-See Foundation is supported by: ClickFix has quickly become a widely adopted infection technique targeting both macOS and Windows users. Rather than relying on software vulnerabilities or exploit chains, it leverages something much simpler: convincing a user to copy and paste a command into a terminal.
Restoring Reflective Code Loading on macOS (Part II)
Restoring Reflective Code Loading on macOS (Part II) Apple silently 'broke' in-memory code loading on macOS ...let's restore it! The Objective-See Foundation is supported by: Note: Parts of this research were originally presented at #OBTS v7.0. In this blog we touch on some of the main highlights and takeaways from the talk, plus provide an open-source PoC. Most importantly though we cover several important updates, such as support for “reflective” Objective-C payloads.
[0day] From Spotlight to Apple Intelligence
[0day] From Spotlight to Apple Intelligence Abusing an 0day to steal the data that fuels macOS AI The Objective-See Foundation is supported by: Want to play along? Towards the end of this blog you'll find a full, open-source PoC! #SharingIsCaring Traditionally, Spotlight is the macOS technology that indexes content on your Mac so that you can easily find whatever you’re looking for.
Objective-See's Blog
TCCing is Believing Apple finally adds TCC events to Endpoint Security! The Objective-See Foundation is supported by: I’m providing an XCode project capable of monitoring the system for TCC events: EndpointSecurity_TCC.xcodeproj Want to play along? Note: You will have to compile this with the macOS 15.4 (beta) SDK! Are you annoyed with many prompts that macOS displays do to, well pretty much anything?
The Mac Malware of 2025 đž
The Mac Malware of 2025 đž A comprehensive analysis of the year's new macOS malware The Objective-See Foundation is supported by: 📝 👾 Want to play along? The samples covered in this post are available in our public malware collection! Also, direct links to each sample are provided in the sections where they are discussed.
The Hidden Treasures of Crash Reports
The Hidden Treasures of Crash Reports Analyzing crash reports reveals malware, bugs, & much more! The Objective-See Foundation is supported by: Sadly, nobody really loves crash reports, but I’m here to change that! This research, a crash course on crash reports, will highlight how these often overlooked files are an invaluable source of information, capable of revealing malware infections, exploitation attempts, or even buggy (exploitable?) system code.
This Meeting Should Have Been an Email
This Meeting Should Have Been an Email A DPRK stealer, dubbed BeaverTail, targets users via a trojanized meeting app The Objective-See Foundation is supported by: 📝 👾 Want to play along? As “Sharing is Caring” I’ve uploaded samples of the malware(s) discussed in this blog post: ▪️ BeaverTail.zip ▪️ InvisibleFerret The password for both is: infect3d ...please though, don't infect yourself! 🙈 New Mac malware on Monday …yay?
Apple Gets an 'F' for Slicing Apples
Apple Gets an 'F' for Slicing Apples Tracking down a subtle bug in an important macOS API The Objective-See Foundation is supported by the "Friends of Objective-See" that include: I’m currently working on Volume II of the “The Art of Mac Malware” (TAOMM) series. This 2nd book is a comprehensive resource that covers the programmatic detection of macOS malware code via behavioral-based heuristics. In other words, it’s all about writing tools to detect malware.
Why Join The Navy If You Can Be A Pirate?
Why Join The Navy If You Can Be A Pirate? Analyzing a pirated application, that contains a (malicious) surprise The Objective-See Foundation is supported by the "Friends of Objective-See" that include: 📝 👾 Want to play along? As ‘Sharing is Caring’ I’ve uploaded a sample of the malware ultraedit.zip.
Analyzing DPRK's SpectralBlur
Analyzing DPRK's SpectralBlur The first malware of 2024 is (already) here! The Objective-See Foundation is supported by the "Friends of Objective-See" that include: 📝 👾 Want to play along? As ‘Sharing is Caring’ I’ve uploaded a sample of the malware SpectralBlur.zip to our public macOS malware collection.
The Mac Malware of 2023 👾
The Mac Malware of 2023 👾 A comprehensive analysis of the year's new malware Objective-See's research, tools, and writing, are supported by the "Friends of Objective-See" such as: 📝 👾 Want to play along? The majority of samples covered in this post are available in our malware collection.
It's Turtles All The Way Down π’
It's Turtles All The Way Down π’ Analyzing the newly discovered "Turtle" ransomware Objective-See's research, tools, and writing, are supported by the "Friends of Objective-See" such as: 📝 👾 Want to play along? As “Sharing is Caring” I’ve uploaded the malicious binaries Turtle.zip to our public macOS malware collection. The password is: infect3d ...please though, don't infect yourself! A few years ago, @jacse mused that maybe turtles are the secret to avoiding ransomware.
Navigating The Latest Tech News, AI Discoveries, And Cybersecurity Updates Blog
Blog Directory > Technology Blogs > TechBeams: Navigating the Latest Tech News, AI Discoveries, and Cybersecurity Updates technology Blog > techbeams.uk Tags: auction house network tecno phantom sticky google search auction house manager exposed whatsapp chrome introduces sticky oneplus ace pro background amidst rampant abuse Embark on an immersive journey through the ever-evolving landscape of technology with TechBeams, your ultimate destination for staying informed about the latest...
The LockBit ransomware (kinda) comes for macOS
The LockBit ransomware (kinda) comes for macOS Analyzing a arm64 mach-O version of LockBit Objective-See's research, tools, and writing, are supported by the "Friends of Objective-See" such as: 📝 👾 Want to play along? As “Sharing is Caring” I’ve uploaded the malicious binary LockBit to our public macOS malware collection.
Ironing out (the macOS) details of a Smooth Operator (Part II)
Ironing out (the macOS) details of a Smooth Operator (Part II) Analyzing UpdateAgent, the 2nd-stage macOS payload of the 3CX supply chain attack Objective-See's research, tools, and writing, are supported by the "Friends of Objective-See" such as: 📝 👾 Want to play along? As “Sharing is Caring” I’ve uploaded the malicious binary UpdateAgent to our public macOS malware collection.
Ironing out (the macOS) details of a Smooth Operator (Part I)
Ironing out (the macOS) details of a Smooth Operator (Part I) The 3CX supply chain attack, gives us an opportunity to analyze a trojanized macOS application Objective-See's research, tools, and writing, are supported by the "Friends of Objective-See" such as: 📝 👾 Want to play along? As “Sharing is Caring” I’ve uploaded the malicious dynamic library libffmpeg.dylib to our public macOS malware collection.
Where there is love, there is ...malware?
Where there is love, there is ...malware? Analyzing a undetected persistent macOS updater Objective-See's research, tools, and writing, are supported by the "Friends of Objective-See" such as: 📝 👾 Want to play along? As “Sharing is Caring” I’ve uploaded the binary iWebUpdate to our macOS malware collection.
The Mac Malware of 2022 👾
The Mac Malware of 2022 👾 A comprehensive analysis of the year's new malware Objective-See's research, tools, and writing, are supported by the "Friends of Objective-See" such as: 📝 👾 Want to play along? All samples covered in this post are available in our malware collection.
The Art of Mac Malware: The Guide to Analyzing Malicious Software|Paperback
English 1718501943 A comprehensive guide to the threats facing Apple computers and the foundational knowledge needed to become a proficient Mac malware analyst. Defenders must fully understand how malicious software works if they hope to stay ahead of the increasingly sophisticated threats facing Apple products today. The Art of Mac Malware: The Guide to Analyzing Malicious Software is a comprehensive handbook to cracking open these malicious programs and seeing what’s inside.
Analyzing OSX.DazzleSpy
Analyzing OSX.DazzleSpy A fully-featured cyber-espionage macOS implant by: Patrick Wardle / January 25, 2022 Objective-See's research, tools, and writing, are supported by the "Friends of Objective-See" such as: 📝 👾 Want to play along? I’ve uploaded an OSX.DazzleSpy sample (password: infect3d) to our macOS malware collection.
Objective-See's Blog
SysJoker analyzing the first (macOS) malware of 2022! by: Patrick Wardle / January 11, 2022 Objective-See's research, tools, and writing, are supported by the "Friends of Objective-See" such as: 📝 👾 Want to play along? I’ve uploaded an macOS SysJoker sample (password: infect3d).
Where's the Interpreter!? (CVE-2021-30853)
Where's the Interpreter!? (CVE-2021-30853) bypassing file quarantine, gatekeeper, & notarization requirements ...again! by: Patrick Wardle / December 22, 2021 Objective-See's research, tools, and writing, are supported by the "Friends of Objective-See" such as: 👾 Want to play along?
The Art of Mac Malware
Download Chapter 2: PERSISTENCE Defenders must fully understand how malicious software works if they hope to stay ahead of the increasingly sophisticated threats facing Apple products today. The Art of Mac Malware: The Guide to Analyzing Malicious Software is a comprehensive handbook to cracking open these malicious programs and seeing what’s inside.
All Your Macs Are Belong To Us
All Your Macs Are Belong To Us bypassing macOS's file quarantine, gatekeeper, and notarization requirements by: Patrick Wardle / April 26, 2021 Our research, tools, and writing, are supported by the "Friends of Objective-See" such as: 📝 👾 Want to play along? I’ve uploaded a sample Proof of Concept. ...when run, it simply pops Calculator.app.
Researcher IDs the first bit of malware optimized for M1 Macs
News "And next year, we're really excited about the first M1 malware that's coming." Screenshot: Apple Security researcher Patrick Wardle has discovered what may be the first malware optimized for Apple Silicon Macs. The malware, details of which he published this week, involves a Safari adware extension called GoSearch22. The adware delivers unwanted ads, collects browser data, and modifies browser settings. GoSearch22 is relatively low risk.
Objective-See's Blog
Arm'd & Dangerous malicious code, now native on apple silicon by: Patrick Wardle / February 14, 2021 📝 👾 Want to play along? I’ve uploaded a sample (password: infect3d).
Discharging ElectroRAT
Discharging ElectroRAT Analyzing the first (macOS) malware of 2021. by: Patrick Wardle / January 5, 2021 Our research, tools, and writing, are supported by the "Friends of Objective-See" such as: 📝 👾 Want to play along?
The Mac Malware of 2020 👾
The Mac Malware of 2020 👾 a comprehensive analysis of the year's new malware by: Patrick Wardle / January 1, 2021 Our research, tools, and writing, are supported by the "Friends of Objective-See": 📝 👾 Want to play along? All samples covered in this post are available in our malware collection.
The Mac Malware of 2021 👾
The Mac Malware of 2021 👾 a comprehensive analysis of the year's new malware! by: Patrick Wardle / January 1, 2021 Objective-See's research, tools, and writing, are supported by the "Friends of Objective-See" such as: 📝 👾 Want to play along? All samples covered in this post are available in our malware collection.
The Mac Malware of 2021 👾
The Mac Malware of 2021 👾 a comprehensive analysis of the year's new malware! by: Patrick Wardle / January 1, 2021 Objective-See's research, tools, and writing, are supported by the "Friends of Objective-See" such as: 📝 👾 Want to play along? All samples covered in this post are available in our malware collection.
Adventures in Anti-Gravity (Part II)
Adventures in Anti-Gravity (Part II) Deconstructing the Mac Variant of GravityRAT by: Patrick Wardle / November 27, 2020 Love these blog posts and/or want to support my research and tools? You can support them via my Patreon page! 📝 👾 Want to play along? I’ve added the samples (GravityRat) to our malware collection (password: infect3d) …please don’t infect yourself! Background In part one, we detailed the (new) macOS variant of GravityRat.
Adventures in Anti-Gravity
Adventures in Anti-Gravity Deconstructing the Mac Variant of GravityRAT by: Patrick Wardle / November 3, 2020 Love these blog posts and/or want to support my research and tools? You can support them via my Patreon page! 📝 👾 Want to play along?
FinFisher Filleted �
FinFisher Filleted ğŸ�Ÿ a triage of the FinSpy (macOS) malware by: Patrick Wardle / September 26, 2020 Love these blog posts and/or want to support my research and tools? You can support them via my Patreon page! 📝 👾 Want to play along?
Apple Approved Malware
Apple Approved Malware malicious code ...now notarized!? #2020 by: Patrick Wardle / August 30, 2020 Love these blog posts and/or want to support my research and tools? You can support them via my Patreon page! Background It wasn’t too long ago, that Apple’s website stated: "[Macs] doesn't get PC viruses. A Mac isn’t susceptible to the thousands of viruses plaguing Windows-based computers.
A true virus on macOS
A true virus on macOS Patrick Wardle (Jamf) Patrick Wardle Jamf Patrick Wardle is the Principal Security Researcher at Jamf and founder of Objective-See. Having worked at NASA and the NSA, as well as presented at countless security conferences, he is intimately familiar with aliens, spies, and talking nerdy.
Office Drama on macOS
Office Drama on macOS infecting macOS via macro-laden documents and 0days by: Patrick Wardle / August 4, 2020 Our research, tools, and writing, are supported by the "Friends of Objective-See" such as: In this blog post complements my recent BlackHat/DefCon talk, "Office Drama on macOS". Abstract: In the world of Windows, macro-based Office attacks are well understood (and frankly are rather old news).
OSX.EvilQuest Uncovered
OSX.EvilQuest Uncovered part i: infection, persistence, and more! Our research, tools, and writing, are supported by the "Friends of Objective-See" such as: 📝 👾 Want to play along?
OSX.EvilQuest Uncovered
OSX.EvilQuest Uncovered analyzing a new piece of mac ransomware (and more!) by: Patrick Wardle / June 29, 2020 Our research, tools, and writing, are supported by the "Friends of Objective-See" such as: 📝 👾 Want to play along?
The Dacls RAT ...now on macOS!
The Dacls RAT ...now on macOS! deconstructing the mac variant of a lazarus group implant. by: Patrick Wardle / May 5, 2020 Our research, tools, and writing, are supported by the "Friends of Objective-See" such as: CleanMy Mac X 📝 👾 Want to play along? I’ve added the sample (‘OSX.Dacls’) to our malware collection (password: infect3d) …please don’t infect yourself! Background Early today, the noted Mac Security researcher Phil Stokes tweeted about a “Suspected #Lazarus backdoor/RAT”: 1.
The 'S' in Zoom, Stands for Security
The 'S' in Zoom, Stands for Security uncovering (local) security flaws in Zoom's latest macOS client by: Patrick Wardle / March 30, 2020 Background Given the current worldwide pandemic and government sanctioned lock-downs, working from home has become the norm …for now.
Weaponizing a Lazarus Group Implant
Weaponizing a Lazarus Group Implant repurposing a 1st-stage loader, to execute custom 'fileless' payloads by: Patrick Wardle / February 22, 2020 Our research, tools, and writing, are supported by the "Friends of Objective-See" such as: CleanMy Mac X 📝 👾 Want to play along?
The Mac Malware of 2019 ð¾
The Mac Malware of 2019 ð¾ a comprehensive analysis of the year's new malware by: Patrick Wardle / January 1, 2020 Our research, tools, and writing, are supported by the "Friends of Objective-See" such as: CleanMy Mac X 📝 👾 Want to play along? All samples covered in this post are available in our malware collection.
Objective-See's Blog
Mass Surveillance, is an (un)Complicated Business triaging a massively popular iOS application, with a dark side by: Patrick Wardle / December 20, 2019 Our research, tools, and writing, are supported by "Friends of Objective-See" such as: CleanMy Mac X 📝 👾 Want to play along?
Mass Surveillance, is an (un)Complicated Business
Mass Surveillance, is an (un)Complicated Business triaging a massively popular iOS application, with a dark side by: Patrick Wardle / December 20, 2019 Our research, tools, and writing, are supported by "Friends of Objective-See" such as: CleanMy Mac X 📝 👾 Want to play along?
How to find stalkerware on your smartphone
The contents of your smartphone may not be as private as you think. Here’s how to check. BY JACK MORSE IMAGE: SDOMINICK / GETTY The digital window to your soul might just have a Peeping Tom. Say hello to stalkerware, a noxious class of software designed to surreptitiously run in the background of smartphones. Its purpose is to keep tabs on everything you do, then report it back to whoever decided to spy on the most intimate and personal details of your life.
Apple’s new Endpoint Security Framework | Blog
A common component of (many) security tools is a process and file monitor. As the name implies, these watch for various processes (start, terminate, etc.) and file (create, open, delete) events. Such monitors often extract meta information such as the process/file path, process arguments and process code-signing information.
Reversing macOS malware eBook Intro By Patrick Wardle
Attacks on the macOS platform are on the rise, but there’s a lack of material for those who want to learn about macOS malware analysis. SentinelOne is delighted to release this eBook to help security researchers learn about this increasingly important topic – Reversing Malware on macOS. I’m strangely fascinated by malware.
Part III: Burned by Fire(fox)
This is Part 3 of a 3 Part series. In Part 1, we identified the malware as OSX.Netwire.A and discussed the infection vectors of the attack. In Part 2, we detailed the malwareâs methods of persistence, and fully reversed the sample to uncover its remotely taskable capabilities. In this next section we will review the second specimen which persists within the attack and creates an additional backdoor.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Patrick
Contact Patrick, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack