SentinelLabs Logo RGB WhitePurp
ABOUT
CVE DATABASE
CONTACT
VISIT SENTINELONE.COM

Phil Stokes

Phil Stokes is a Threat Researcher at SentinelOne, specializing in macOS threat intelligence, platform vulnerabilities and malware analysis. He began his journey into macOS security as a software developer, creating end user troubleshooting and security tools just at the time when macOS adware and commodity malware first began appearing on the platform. Phil has been closely following the development of macOS threats as well as researching Mac software and OS vulnerabilities since 2014.
MacOS Incident Response   Part 2  User Data Activity And Behavior 2
labs
Security Research

macOS Incident Response | Part 2: User Data, Activity and Behavior

Phil Stokes / August 28, 2019

What can we learn about user activity and behavior on a compromised Mac? Learn about the hidden and obfuscated data stores Apple use on the macOS platform.

Read More
MacOS Incident Response   Part 1  Collecting Device File System Data 1
labs
Security Research

macOS Incident Response | Part 1: Collecting Device, File & System Data

Phil Stokes / August 21, 2019

How should you investigate an infected Mac? Has there been lateral movement, data exfiltration, system manipulation? Learn macOS incident response here.

Read More
sentinelone

The Good, the Bad and the Ugly in Cybersecurity – Week 33

The Good, the Bad and the Ugly | 3 minute read
Read More >
sentinelone

Malware Hunting on macOS | A Practical Guide

macOS | 14 minute read
Read More >
sentinelone

10 macOS Malware Outbreaks from 2019

macOS | 13 minute read
Read More >
sentinelone

How Two Firefox Zero Days Led to Two macOS Backdoors

macOS | 8 minute read
Read More >
sentinelone

How Malware Persists on macOS

macOS | 11 minute read
Read More >
Lazarus APT Targets Mac Users With Poisoned Word Document 4 Scaled 1600x900
labs
Security & Intelligence

Lazarus APT Targets Mac Users with Poisoned Word Document

Phil Stokes / April 25, 2019

Threat actors have the know-how to develop campaigns that target your weakest link. Learn how Lazarus APT took their malware to Apple’s macOS platform.

Read More
sentinelone

How to Reverse Malware on macOS Without Getting Infected | Part 3

From the Front Lines, macOS | 10 minute read
Read More >
sentinelone

How to Reverse Malware on macOS Without Getting Infected | Part 2

From the Front Lines, macOS | 8 minute read
Read More >
Previous
1 … 14 15 16 17 18 19
Next

SentinelLabs

In the era of interconnectivity, when markets, geographies, and jurisdictions merge in the melting pot of the digital domain, the perils of the threat ecosystem become unparalleled. Crimeware families achieve an unparalleled level of technical sophistication, APT groups are competing in fully-fledged cyber warfare, while once decentralized and scattered threat actors are forming adamant alliances of operating as elite corporate espionage teams.

Recent Posts

  • Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets
    Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets
    June 9, 2025
  • FreeDrain Unmasked | Uncovering an Industrial-Scale Crypto Theft Network
    FreeDrain Unmasked | Uncovering an Industrial-Scale Crypto Theft Network
    May 8, 2025
  • Top Tier Target | What It Takes to Defend a Cybersecurity Company from Today’s Adversaries
    Top Tier Target | What It Takes to Defend a Cybersecurity Company from Today’s Adversaries
    April 28, 2025

Sign Up

Get notified when we post new content.

Thanks! Keep an eye out for new content!

  • Twitter
  • LinkedIn
©2025 SentinelOne, All Rights Reserved.