SentinelLabs Logo RGB WhitePurp
ABOUT
CONTACT
VISIT SENTINELONE.COM

Phil Stokes

Phil Stokes is a Research Engineer at SentinelOne, specializing in macOS threat intelligence, platform vulnerabilities and malware analysis. He began his journey into macOS security as a software developer, creating end user troubleshooting and security tools just at the time when macOS adware and commodity malware first began appearing on the platform. Phil has been closely following the development of macOS threats as well as researching Mac software and OS vulnerabilities since 2014.
How To Reverse Malware On MacOS Without Getting Infected Part 3 1600x900
labs

How to Reverse Malware on macOS Without Getting Infected | Part 3

Phil Stokes / April 17, 2019

Join us in the final part of our introduction to macOS malware reverse engineering as we explore LLDB, dynamic binary analysis, reading registers and more.

Read More
Reverse Mac 1600x900
labs

How to Reverse Malware on macOS Without Getting Infected | Part 2

Phil Stokes / April 9, 2019

Continue learning how to reverse malware on Apple macOS with Part 2 in our series. Learn about Apple's Mach-O native binary format and how to decode it

Read More
Lewis Ngugi 186309 Unsplash 1 1600x900
labs

How to Reverse Malware on macOS Without Getting Infected | Part 1

Phil Stokes / April 4, 2019

Ever wanted to learn how to reverse malware on Apple macOS? This is the place to start! Join us in this 3-part series on macOS reverse engineering skills.

Read More
WHAT IS ENDPOINT SECURITY SOFTWARE  – DEFINITION BENEFIT 1
labs

Malicious PDFs | Revealing the Techniques Behind the Attacks

Phil Stokes / March 27, 2019

PDF files are great for users, and crafted PDFs are great for cybercriminals! How do attackers turn a PDF into a malicious attack vector? Find out here!

Read More
Left Behind 1600x900
labs

Don’t Get Left Behind – Why Apple’s macOS Isn’t Secure Without Next Gen Protection

Phil Stokes / March 21, 2019

Do Apple Macs get infected with malware? Do Apple's built-in protections mean Macs are secure? We take a look inside macOS endpoint security to find out.

Read More
Extentions
labs

How Safe Are Browser Extensions? Adware In Browsers

Phil Stokes / March 13, 2019

Browser extensions hijacking search queries may do more than just deliver unwanted ads. What are the risks, and will your browser protect you? We find out.

Read More
1 Mrt App In Coreservices 1600x900
labs

Apple Malware: Uncovering the Mysterious Removal (MRT) Tool Update

Phil Stokes / February 14, 2019

Apple's little known malware removal tool gets a signature update. But what is this new malware family MACOS.35846e4? Find out on this journey inside MRT

Read More
2 Column View
labs

Mac Malware OSX.Dok is Back, Actively Infecting Victims

Phil Stokes / January 17, 2019

Man-in-the-middle macOS malware is back infecting unsuspecting users. Learn how it works and how we discovered new infections.

Read More
Post Default
labs

How WindTail Bypasses macOS Gatekeeper Settings

Phil Stokes / January 3, 2019

Malware authors know how to easily bypass Gatekeeper, but macOS users continue to believe they are protected by Apple's built-in security technologies

Read More
Safari Safe Prefs
labs

A Review of Malware Affecting macOS in 2018

Phil Stokes / December 20, 2018

As 2018 winds down, we take a look at how the macOS malware situation unfolded throughout the year. How safe is Apple's platform at the end of the year?

Read More
Previous
1 … 16 17 18 19 20
Next

SentinelLabs

In the era of interconnectivity, when markets, geographies, and jurisdictions merge in the melting pot of the digital domain, the perils of the threat ecosystem become unparalleled. Crimeware families achieve an unparalleled level of technical sophistication, APT groups are competing in fully-fledged cyber warfare, while once decentralized and scattered threat actors are forming adamant alliances of operating as elite corporate espionage teams.

Recent Posts

  • LABScon25 Replay | Breach Alpha: Trading on Cyber Fallout
    LABScon25 Replay | Breach Alpha: Trading on Cyber Fallout
    May 14, 2026
  • PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale
    PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale
    May 7, 2026
  • LABScon25 Replay | Please Connect to the Foreign Entity to Enhance Your User Experience
    LABScon25 Replay | Please Connect to the Foreign Entity to Enhance Your User Experience
    May 6, 2026

Sign Up

Get notified when we post new content.

Thanks! Keep an eye out for new content!

  • Twitter
  • LinkedIn
©2026 SentinelOne, All Rights Reserved.