CEO/Co-Founder of Phorion 👨💻| macOS researcher 🍎 | BlackHat speaker 2021 📢 Opinions are my own
Brisbane, Queensland
Joined May 2011
- Tweets6.9K
- Following344
- Followers975
- Likes3.8K
Pinned Tweet
Time to go to Vegas!
More than happy to announce that @rookuu_ and I have been accepted to talk at Black Hat USA 🇺🇸
"Come to the Dark Side, We Have Apples: Turning macOS Management Evil".
blackhat.com/us-21/briefings…
Calum Hall retweeted
This chat with @MehulRevankar was a lot of fun.
You can catch us talking about building cyber security startups, bootstrapping vs raising, and building products that people love.
youtu.be/5wlYXiM0fOk?si=qBl0…
The AI prompt collection we’ve introduced here is 🔥
An AI agent uploaded internal files to Pastebin. You can see what happened, but do you know why it did it?
Our latest post walks through how to use AI agent context during alert triage, even if your endpoint tooling doesn’t collect it for you.
phorion.io/blog/ai-agent-tri…
Calum Hall retweeted
It’s not every day we encounter metamorphic ransomware targeting macOS! 👀
Our @patrickwardle recently presented at @macsysadmin & @virusbtn on “Heartbreaker,” a new ransomware sample that rewrites & recompiles itself every time it runs!
Blog & slides: objective-see.org/blog/blog_…
If you’re a blue teamer this series is worth throwing some eyes on 👀
We’re seeing a complete shift in endpoint activity as a result of chaotic AI workloads. Short term the noise is rough for security teams - but it’s all about finding the visibility and controls to adapt.
Part 1 of Phorion's Endpoint Security in the AI Age is here!
AI agents are changing endpoint security. Alert fidelity is dropping, and traditional tuning isn’t keeping up. A new era calls for a new approach to defending endpoints.
phorion.io/blog/ai-endpoint-…
Calum Hall retweeted
This is an an excellent lineup of talks, and I'm honored to present again, along with @gergely_kalman . We will hack macOS like it's the 80s!
This will be my 7th OBTS talk, can't believe time flies so fast.
My favorite conference, small, awesome speakers, people, great community, great chats for 3 days, can't wait to be back ❤️
Just announced: talks for #OBTS v9 🥳
Stoked on an epic lineup of cutting-edge 🍎- security research, covering exploitation, malware, reversing, security tools, AI, & more!
Check out the full lineup:
objectivebythesea.org/v9/tal…
Which one(s) are you most looking forward to!? 🤔
The power of Phorion Protections is nuts 🔥 Being built into the EDR gives you full historical analytics on any file/process controls that you implement.
Prevent anomalous activity wherever you can, and where you can’t - have the detections in place to catch edge cases.
Raising the bar for macOS security once again. We are proud to introduce Phorion Protections 🚀
File access authorisation and process execution controls built directly into your EDR. No tool sprawl, no gaps between tooling and no additional cost to customers. 💻
phorion.io/blog/phorion-prot…
Hats off to Apple for bringing in some controls for ClickFix.
But I'm pretty stoked with how Phorion builds on top of this at an enterprise level with our clipboard protection 🍎
Calum Hall retweeted
Phorion just ranked #1 in the EDR Telemetry Project’s macOS evaluation, more than 2x the next vendor.
Most cross-platform EDRs miss critical telemetry. These gaps decide whether you see an attack or miss it.
Full breakdown → phorion.io/blog/edr-telemetr…
Calum Hall retweeted
Playing with Apple’s latest ESF events took a little bit more work this time around!
I’ve written up a post on exploring the new undocumented socket bind events or ES_EVENT_TYPE_RESERVED_3 and _4.
phorion.io/blog/reverse-engi…
Calum Hall retweeted
If you're looking for a framework to benchmark macOS EDR capabilities, checkout the latest update to the EDR Telemetry Project! 🍎
It is open-source and community-run.
If you have access to an EDR, consider submitting a PR to rank its capabilities!
@Kostastsale
edr-telemetry.com/blog/macOS…
🤖 Made with AI
ALT macOS EDR telemetry update
Awesome job from the Phorion team on the results of the EDR Telemetry Project 🚀
edr-telemetry.com/macos
Calum Hall retweeted
It’s been quiet on the EDR Telemetry side lately while working on something big!
EDR telemetry's goal was always to set the standard for telemetry visibility, and this is what we're planning to do with tomorrow's release...
Keep an eye out for tomorrow's announcement!
Glad to see @PhorionTech being the one vendor to bring up the average 🤘
Hopefully this inspires some progression in the world of macOS. Phorion is raising the bar on what we can detect on macOS!
During our research, it’s become apparent that EDRs need to do a better job of collecting telemetry from macOS endpoints. Head over to the edr-telemetry.com/macos to checkout the results yourselves. While you’re there, checkout the scores as well to see how they compare.
Out of the ~43 total points, the average is 16… and that’s with one EDR bringing up the average 🙂
Calum Hall retweeted
I built a tool to monitor Apple Events on macOS.
It surfaces abuse of tools like osascript and helps detect techniques like fake password prompts, even when "display dialog" never appears on the command line.
Calum Hall retweeted
"There is no ES_EVENT_TYPE_AUTH_PASTE (or equivalent) event" ...yet!
Apple, please!? 🤞🏼
Motivated by @moonlock_lab’s recent findings on ClickFix attacks surfacing via Google Search results and even LLMs 🤯, I’ve added basic protection against most of these attacks to BlockBlock 🍎🛡️
Read: “ClickFix: Stopped at ⌘+V”
objective-see.org/blog/blog_…
Calum Hall retweeted
We’re off to a great start with macOS telemetry. Big thanks to @OliviaGalluccii for kicking things off and leading the initial work to bring macOS into the EDR Telemetry Project next year.
She opened the first PR defining macOS telemetry categories and rationale.
Now is the time to share your thoughts, as we’re actively deciding which events and telemetry make it into this first and most important iteration of macOS support!
github.com/tsale/EDR-Telemet…
Calum Hall retweeted
Been working hard on KnockKnock v4.0 that'll have new persistence enumerations, better VirusTotal integration, & many new community-requested features & improvements! 😍
Want to take a prerelease for a spin? github.com/objective-see/Kno…
...just lmk if anything breaks 😅🙏🏽
Calum Hall retweeted
Phorion Threat Report: a backdoored Cursor extension was used to deploy the Paradox Stealer infostealer into macOS developer workflows.
The post breaks down the full infection chain, detection opportunities and why IDE extensions have become a reliable point of initial access.
phorion.io/blog/macos-parado…
Calum Hall retweeted
The lures used in this attack are crazy effective. A malicious Cursor extension that looks legitimate, shows five star reviews and displays more "downloads" than the genuine extension it impersonated...
A lot of familiar trust signals being tampered with here.
Phorion Threat Report: a backdoored Cursor extension was used to deploy the Paradox Stealer infostealer into macOS developer workflows.
The post breaks down the full infection chain, detection opportunities and why IDE extensions have become a reliable point of initial access.
phorion.io/blog/macos-parado…
Infostealers coming in through malicious IDE extensions is the stuff of nightmares if you’re looking after a dev environment 🍎
Phorion Threat Report: a backdoored Cursor extension was used to deploy the Paradox Stealer infostealer into macOS developer workflows.
The post breaks down the full infection chain, detection opportunities and why IDE extensions have become a reliable point of initial access.
phorion.io/blog/macos-parado…