Endpoint Research Lead at @HuntressLabs | Creator of @Crash_Security | π
Portland, OR
Joined March 2016
- Tweets7.2K
- Following1.3K
- Followers1.8K
- Likes16.3K
Stuart Ashenbrenner πΊπΈ π¨π¦ retweeted
I am still on the hunt for an experienced Windows EDR researcher with @stuartjash to come develop new ways to make environments hostile to threats.
US-based due to some synchronous obligations, let us know if youβre interested.
Stuart Ashenbrenner πΊπΈ π¨π¦ retweeted
Jamf Threat Labs uncovered fake macOS installers tied to Contagious Interview. The threat actors continue to test new ways to deliver their malicious payloads.
Read more about it on our blog.
jamf.com/blog/contagious-intβ¦
#macos #malware #ioc #dprk
Stuart Ashenbrenner πΊπΈ π¨π¦ retweeted
Just announced: talks for #OBTS v9 π₯³
Stoked on an epic lineup of cutting-edge π- security research, covering exploitation, malware, reversing, security tools, AI, & more!
Check out the full lineup:
objectivebythesea.org/v9/talβ¦
Which one(s) are you most looking forward to!? π€
Stuart Ashenbrenner πΊπΈ π¨π¦ retweeted
Jamf Threat Labs uncovered a macOS campaign using a fake Zoom installer to deliver Overlord RAT.
The downloader (ZoomMeetings) is a self-contained .NET 10 Mach-O binary, unusual for macOS malware.
Because .NET is cross-platform, the same codebase also targets Windows.
jamf.com/blog/fake-zoom-instβ¦
#malware #macOS #reverseengineering #RAT
Stuart Ashenbrenner πΊπΈ π¨π¦ retweeted
π¨ The CFP for #OBTS v9 closes this Friday (July 31)!
Have some novel or innovative Apple security research to share? We'd love to see your submission:
objectivebythesea.org/v9/cfpβ¦
Welcoming submissions on any Apple security topic (offensive & defensive)! πππ‘οΈ
Our Valentine's Day gift π
objectivebythesea.org/v9/indβ¦
Announcing Objective by the Sea (#OBTS) v9.0:
π©π»βπΌ Train: Nov 15-17
π©π»βπ« Talks: Nov 18-20
π Maui, Hawaii, 2026
CFP (talks & trainings) and tickets are now officially open! Hope to see you by the sea ποΈ
Special ππ½ to @andyrozen!!
One of the most time consuming parts of macOS research is identifying what you're looking at - AMOS, NovaStealer, DigitStealer, MacSync, or maybe Shlayer or Adload.
You can now pull in this Malware Research skill to help you classify malware quickly.
blog.crashsecurity.io/macos-β¦
Included is a list of sources, both websites and ICs that are fantastic researchers in the space
github.com/stuartjash/macos-β¦
I attempted to do this with the Malware KB, but that still required sifting through the many websites and articles. This repo, either as a standalone dataset or integrated as an AI skill, can help map IOCs and samples to different malware families.
github.com/stuartjash/macos-β¦
The Jamf team just dropping some awesome stuff on a Monday morning π₯ Nice work, @txhaflaire
Meet CrashStealer. This one takes delivery more seriously than most, a signed and Apple-notarized dropper that's pulling its second stage payload down through GitHub.
The payload is a native C++ stealer with client-side AES-GCM encryption and layered anti-analysis.
Check out our writeup for additional details and indicators of compromise.
jamf.com/blog/crashstealer-mβ¦
#infostealer #malware #macos #threatresearch
Stuart Ashenbrenner πΊπΈ π¨π¦ retweeted
Meet CrashStealer. This one takes delivery more seriously than most, a signed and Apple-notarized dropper that's pulling its second stage payload down through GitHub.
The payload is a native C++ stealer with client-side AES-GCM encryption and layered anti-analysis.
Check out our writeup for additional details and indicators of compromise.
jamf.com/blog/crashstealer-mβ¦
#infostealer #malware #macos #threatresearch
Stuart Ashenbrenner πΊπΈ π¨π¦ retweeted
Neat addition to EndpointSecurity with deadline manipulation in the macOS 27 beta
Stuart Ashenbrenner πΊπΈ π¨π¦ retweeted
New AMOS campaign details.
Attackers are using a phishing page hosted on sites.google.com, tricking users into executing a malicious command in Terminal:
hxxps://api-metrics-5453[.]com/curl/3e97b0eddfddb28e10008f9348381b2665e1ad12476315b24a64808696c3347b
The bash script downloads and launches the next-stage stager: βhelperβ.
βhelperβ is a heavily obfuscated loader/dropper. It does not steal data directly, but prepares and launches the next stage (AMOS stealer + backdoor).
The rest you already know.
Infrastructure:
api-metrics-5453[.]com β first stage
prismdata48[.]com β Phishing site
solidlattice65[.]com β Phishing site
#AMOS #STEALER #macOS #malware #detection
Stuart Ashenbrenner πΊπΈ π¨π¦ retweeted
Spent some time with Claude this weekend making an Endpoint Security reference for research and development. Checks for the latest SDK, parses the ES headers, and publishes. Includes a dedicated ES change log and telemetry matrix.
esapi.swiftlydetecting.com/
Stuart Ashenbrenner πΊπΈ π¨π¦ retweeted
Follow our research with the new @JamfThreatLabs handle! We may also share some additional intel on the macOS threat landscape from time to time!
Stuart Ashenbrenner πΊπΈ π¨π¦ retweeted
You can now build macOS firewalls/network tools via Endpoint Security - no Network Ext. needed! π€―
Reversing macOS 24.6βs new ES_EVENT_TYPE_RESERVED_* ES events shows some are network auth/notify hooks
Read: βBuilding a Firewallβ¦via Endpoint Security!?β
objective-see.org/blog/blog_β¦
Stuart Ashenbrenner πΊπΈ π¨π¦ retweeted
In macOS Tahoe 26.4 Apple added a new security feature to Terminal that warns users of potentially malicious pastes with a "Possible malware, Paste blocked" prompt. Here how it actually works π§΅
Stuart Ashenbrenner πΊπΈ π¨π¦ retweeted
I've exited from tech and am doing guided tours in and around Yellowstone.
backroadsbear.com
Thanks to everyone for some great years! This will be my last post here. π¬
Stuart Ashenbrenner πΊπΈ π¨π¦ retweeted
DFIR analysts who use macOS as their daily driver deserve free and native forensic tooling. So I built one. π
Introducing ππ₯ππΉπΌπ π§πΆπΊπ²πΉπΆπ»π² β a timeline analysis app built from the ground up for Mac-based DFIR folks, forensic investigators, or SOC analysts. Built in appreciation of, and inspired by, Eric Zimmermanβs Timeline Explorer.
Every feature in this tool was shaped by real IR casework. Handling massive timelines, parsing artifacts here and there, and pivoting across logs during active investigations. I built IRFlow Timeline to be the native macOS timeline analyzer that actually keeps up with a live case. Every button and view is intentional; if itβs in the app, itβs because I needed it mid-case and realized the standard tools fell short.
No dependencies. Zero setup. Just drag, drop, and analyze.
#dfir #incidentresponse #timeline #macos #threathunitng #digitalforensics