SentinelLabs Logo RGB WhitePurp
ABOUT
CONTACT
VISIT SENTINELONE.COM

Phil Stokes

Phil Stokes is a Research Engineer at SentinelOne, specializing in macOS threat intelligence, platform vulnerabilities and malware analysis. He began his journey into macOS security as a software developer, creating end user troubleshooting and security tools just at the time when macOS adware and commodity malware first began appearing on the platform. Phil has been closely following the development of macOS threats as well as researching Mac software and OS vulnerabilities since 2014.
25 MKTG Comms Blog 022 Generic LABS Blog Images 07
labs
Advanced Persistent Threat

macOS NimDoor | DPRK Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware

Phil Stokes & Raffaele Sabato / July 2, 2025

NimDoor shows how threat actors are continuing to explore cross-platform languages that introduce new levels of complexity for analysts.

Read More
CryptoDrain Soc
labs
Security Research

FreeDrain Unmasked | Uncovering an Industrial-Scale Crypto Theft Network

Tom Hegel, Kenneth Kinion (Validin) & Sreekar Madabushi (Validin) / May 8, 2025

FreeDrain is a modern, scalable phishing operation exploiting weaknesses in free publishing platforms to steal cryptocurrency on a global scale.

Read More
AkiraBot Ftr
labs
Crimeware

AkiraBot | AI-Powered Bot Bypasses CAPTCHAs, Spams Websites At Scale

Alex Delamotte & Jim Walter / April 9, 2025

AkiraBot uses OpenAI to generate custom outreach messages to spam chat widgets and website contact forms at scale.

Read More
ReaderUpdate 7
labs

ReaderUpdate Reforged | Melting Pot of macOS Malware Adds Go to Crystal, Nim and Rust Variants

Phil Stokes & Raffaele Sabato / March 25, 2025

A widespread campaign with binaries written in different source languages, ReaderUpdate presents unique challenges for detection and analysis.

Read More
CasS Leaks Ftr
labs
Security & Intelligence

Censorship as a Service | Leak Reveals Public-Private Collaboration to Monitor Chinese Cyberspace

Alex Delamotte, Aleksandar Milenkoski & Dakota Cary / February 21, 2025

Data leak reveals how a top tier cybersecurity vendor helps the PRC enforce content monitoring and manipulation of public opinion in China.

Read More
MacOS Ferret Bg
labs

macOS FlexibleFerret | Further Variants of DPRK Malware Family Unearthed

Phil Stokes & Tom Hegel / February 3, 2025

DPRK 'Contagious Interview' campaign continues to target Mac users with new variants of FERRET malware and GitHub devs with repo spam.

Read More
Mac Malware 20242
labs

2024 macOS Malware Review | Infostealers, Backdoors, and APT Campaigns Targeting the Enterprise

Phil Stokes / January 20, 2025

Learn about the key macOS malware families from 2024, including tactics, IoCs, opportunities for detection, and links to further reading.

Read More
DPRK Front V3 Ftr
labs
Adversary

DPRK IT Workers | A Network of Active Front Companies and Their Links to China

Tom Hegel & Dakota Cary / November 21, 2024

SentinelLABS has identified multiple deceptive websites linked to businesses in China fronting for North Korea's fake IT workers scheme.

Read More
BNThief Feature
labs
Advanced Persistent Threat

BlueNoroff Hidden Risk | Threat Actor Targets Macs with Fake Crypto News and Novel Persistence

Raffaele Sabato, Phil Stokes & Tom Hegel / November 7, 2024

SentinelLABS has observed a suspected DPRK threat actor targeting Crypto-related businesses with novel multi-stage malware.

Read More
MacOS NotLockBit Evolving Ransomware Samples Suggest A Threat Actor Sharpening Its Tools2
labs

macOS NotLockBit | Evolving Ransomware Samples Suggest a Threat Actor Sharpening Its Tools

Phil Stokes / October 22, 2024

An unknown threat actor is developing ransomware to lock files and steal data on macOS, and it's not LockBit.

Read More
Previous
1 2 3 4 … 20
Next

SentinelLabs

In the era of interconnectivity, when markets, geographies, and jurisdictions merge in the melting pot of the digital domain, the perils of the threat ecosystem become unparalleled. Crimeware families achieve an unparalleled level of technical sophistication, APT groups are competing in fully-fledged cyber warfare, while once decentralized and scattered threat actors are forming adamant alliances of operating as elite corporate espionage teams.

Recent Posts

  • PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale
    PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale
    May 7, 2026
  • LABScon25 Replay | Please Connect to the Foreign Entity to Enhance Your User Experience
    LABScon25 Replay | Please Connect to the Foreign Entity to Enhance Your User Experience
    May 6, 2026
  • fast16 | Mystery Shadow Brokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet
    fast16 | Mystery Shadow Brokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet
    April 23, 2026

Sign Up

Get notified when we post new content.

Thanks! Keep an eye out for new content!

  • Twitter
  • LinkedIn
©2026 SentinelOne, All Rights Reserved.