SentinelLabs Logo RGB WhitePurp
ABOUT
CONTACT
VISIT SENTINELONE.COM

Phil Stokes

Phil Stokes is a Research Engineer at SentinelOne, specializing in macOS threat intelligence, platform vulnerabilities and malware analysis. He began his journey into macOS security as a software developer, creating end user troubleshooting and security tools just at the time when macOS adware and commodity malware first began appearing on the platform. Phil has been closely following the development of macOS threats as well as researching Mac software and OS vulnerabilities since 2014.
Sequoia Beta
labs

macOS Sequoia | What’s New in Privacy and Security for Enterprise?

Phil Stokes / September 17, 2024

Monday September 16th saw Apple release the newest version of its Mac operating system, macOS 15 Sequoia, and SentinelOne was delighted to announce support for this version of macOS on the day of release.

Read More
From Amos To Poseidon A SOC Teams Guide To Detecting MacOS Atomic Stealers 2024 Ver2 2
labs

From Amos to Poseidon | A SOC Team’s Guide to Detecting macOS Atomic Stealers 2024

Phil Stokes / September 12, 2024

Keeping track of the many variants of Atomic Stealer can be a challenge for SOC teams. Our guide breaks down the latest versions.

Read More
Exploring  VT Bus Ftr
labs
Security Research

Exploring the VirusTotal Dataset | An Analyst’s Guide to Effective Threat Research

Aleksandar Milenkoski & Jose Luis Sánchez Martínez (VirusTotal) / August 29, 2024

We teamed up with VirusTotal to take a deep dive into the platform's extensive query capabilities through both the web and API interfaces.

Read More
Cuckoo Ftr
labs

macOS Cuckoo Stealer | Ensuring Detection and Defense as New Samples Rapidly Emerge

Phil Stokes / May 9, 2024

Learn about the mechanics of macOS Cuckoo Stealer, discover extended indicators and ensure your organization remains protected.

Read More
Adload Prolific Bg
labs

macOS Adload | Prolific Adware Pivots Just Days After Apple’s XProtect Clampdown 

Phil Stokes / May 1, 2024

Learn about the latest Adload adware variants, written in Go and intended to bypass Apple's recent XProtect updates.

Read More
Backdoor Activator Malware Running Rife 18
labs

Backdoor Activator Malware Running Rife Through Torrents of macOS Apps

Phil Stokes / February 1, 2024

A new campaign is spreading macOS malware through infected copies of popular applications and productivity tools.

Read More
The Many Faces Of Undetected MacOS InfoStealers KeySteal Atomic CherryPie Continue To Adapt 8b
labs

The Many Faces of Undetected macOS InfoStealers | KeySteal, Atomic & CherryPie Continue to Adapt

Phil Stokes / January 15, 2024

Learn about the latest threats to macOS as Infostealers continue to rapidly adapt to evade static signatures.

Read More
MacOS MetaStealer New Family Of Obfuscated Go Infostealers Spread In Targeted Attacks 3
labs

macOS MetaStealer | New Family of Obfuscated Go Infostealers Spread in Targeted Attacks 

Phil Stokes / January 11, 2024

The rise of macOS infostealers continues with the latest entrant aiming to compromise business environments with targeted social engineering lures.

Read More
By Phil Stokes Protecting MacOS 7 Strategies For Enterprise Security In 2024 1
labs

Protecting macOS |  7 Strategies for Enterprise Security in 2024

Phil Stokes / January 2, 2024

What can defenders learn from last year's bumper crop of macOS malware? Bolster your defenses with these insights into the latest attacker trends.

Read More
DPRK Crypto Theft MacOS RustBucket Droppers Pivot To Deliver KandyKorn Payloads 1
labs

DPRK Crypto Theft | macOS RustBucket Droppers Pivot to Deliver KandyKorn Payloads

Phil Stokes / November 27, 2023

Two apparently separate North Korean crypto theft campaigns targeting macOS users appear to be linked as threat actors mix and match droppers and payloads.

Read More
Previous
1 2 3 4 5 … 20
Next

SentinelLabs

In the era of interconnectivity, when markets, geographies, and jurisdictions merge in the melting pot of the digital domain, the perils of the threat ecosystem become unparalleled. Crimeware families achieve an unparalleled level of technical sophistication, APT groups are competing in fully-fledged cyber warfare, while once decentralized and scattered threat actors are forming adamant alliances of operating as elite corporate espionage teams.

Recent Posts

  • fast16 | Mystery ShadowBrokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet
    fast16 | Mystery ShadowBrokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet
    April 23, 2026
  • LABScon25 Replay | Are Your Chinese Cameras Spying For You Or On You?
    LABScon25 Replay | Are Your Chinese Cameras Spying For You Or On You?
    April 22, 2026
  • Building an Adversarial Consensus Engine | Multi-Agent LLMs for Automated Malware Analysis
    Building an Adversarial Consensus Engine | Multi-Agent LLMs for Automated Malware Analysis
    March 19, 2026

Sign Up

Get notified when we post new content.

Thanks! Keep an eye out for new content!

  • Twitter
  • LinkedIn
©2026 SentinelOne, All Rights Reserved.