SentinelLabs Logo RGB WhitePurp
ABOUT
CONTACT
VISIT SENTINELONE.COM

Phil Stokes

Phil Stokes is a Research Engineer at SentinelOne, specializing in macOS threat intelligence, platform vulnerabilities and malware analysis. He began his journey into macOS security as a software developer, creating end user troubleshooting and security tools just at the time when macOS adware and commodity malware first began appearing on the platform. Phil has been closely following the development of macOS threats as well as researching Mac software and OS vulnerabilities since 2014.
Bloated Binaries How To Detect And Analyze Multi Megabyte MacOS Malware 8
labs
Security Research

Bloated Binaries | How to Detect and Analyze Large macOS Malware Files

Phil Stokes / August 29, 2023

Massive malware binaries are becoming more common on macOS and can cause problems for detection and analysis. Here's how we can successfully deal with them.

Read More
New MacOS XLoader Variant Masquerades As Signed OfficeNote App By Dinesh Devadoss And Phil Stokes 7
labs

XLoader’s Latest Trick | New macOS Variant Disguised as Signed OfficeNote App

Dinesh Devadoss & Phil Stokes / August 21, 2023

Notorious botnet and infostealer XLoader makes a return to macOS with a new dropper and malware payload.

Read More
3 Hidden Facts About MacOS Security Every Security Team Should Know 8
labs

Mac Admins | Why Apple’s Silent Approach to Endpoint Security Should be a Wake-Up Call

Phil Stokes / August 2, 2023

There's a lot of security-related events quietly going on under the hood of macOS that could indicate a compromise, but your security team may never know.

Read More
Apple Crimeware Massive Rust Infostealer Campaign Aiming For MacOS Sonoma Ahead Of Public Release 3
labs

Apple Crimeware | Massive Rust Infostealer Campaign Aiming for macOS Sonoma Ahead of Public Release

Phil Stokes / July 25, 2023

Crimeware actors have launched an extensive campaign to target macOS users with malware disguised in multiple fake blockchain games.

Read More
BlueNoroff How DPRKs MacOS RustBucket Seeks To Evade Analysis And Detection 5
labs

BlueNoroff | How DPRK’s macOS RustBucket Seeks to Evade Analysis and Detection

Phil Stokes / July 5, 2023

Threat actors are using increasingly sophisticated forms of evasion and anti-analysis as they respond to increased attention to macOS security in the enterprise.

Read More
JokerSpy Unknown Adversary Targeting Organizations With Multi Stage MacOS Malware 5
labs

JokerSpy | Unknown Adversary Targeting Organizations with Multi-Stage macOS Malware

Phil Stokes / June 28, 2023

JokerSpy appears to be part of a larger campaign that is likely targeting more organizations than currently known. Learn how to detect it and stay protected.

Read More
Automating String Decryption And Other Reverse Engineering Tasks In Radare2 With R2pipe By Phil Stokes 1
labs
Security Research

Automating String Decryption and Other Reverse Engineering Tasks in radare2 With r2pipe

Phil Stokes / June 21, 2023

Learn how to drive radare2 with r2pipe for automated binary analysis, string decryption and other common reversing tasks.

Read More
MacOS 14 Sonoma Toughening Up MacOS For The Enterprise 1
labs

macOS 14 Sonoma | Toughening up macOS for the Enterprise?

Phil Stokes / June 8, 2023

What's new in the latest macOS upgrade? Take a tour around some of the enhancements as Apple looks to make macOS better suited for the workplace.

Read More
Radare2 Power Ups Delivering Faster MacOS Malware Analysis With R2 Customization 5
labs
Security Research

Radare2 Power Ups | Delivering Faster macOS Malware Analysis With r2 Customization

Phil Stokes / May 31, 2023

Learn how to customize radare2 with user-defined aliases, macros and functions for faster and easier binary diffing and analysis.

Read More
Geacon Brings Cobalt Strike Capabilities To MacOS Threat Actors 1
labs

Geacon Brings Cobalt Strike Capabilities to macOS Threat Actors

Phil Stokes & Dinesh Devadoss / May 15, 2023

An uptick in malicious macOS payloads contain Cobalt Strike Beacons written in Go and derived from a Chinese open-source repository.

Read More
Previous
1 2 3 4 5 6 … 19
Next

SentinelLabs

In the era of interconnectivity, when markets, geographies, and jurisdictions merge in the melting pot of the digital domain, the perils of the threat ecosystem become unparalleled. Crimeware families achieve an unparalleled level of technical sophistication, APT groups are competing in fully-fledged cyber warfare, while once decentralized and scattered threat actors are forming adamant alliances of operating as elite corporate espionage teams.

Recent Posts

  • Silent Brothers | Ollama Hosts Form Anonymous AI Network Beyond Platform Guardrails
    Silent Brothers | Ollama Hosts Form Anonymous AI Network Beyond Platform Guardrails
    January 29, 2026
  • LABScon25 Replay | How to Bug Hotel Rooms v2.0
    LABScon25 Replay | How to Bug Hotel Rooms v2.0
    January 21, 2026
  • LLMs in the SOC (Part 1) | Why Benchmarks Fail Security Operations Teams
    LLMs in the SOC (Part 1) | Why Benchmarks Fail Security Operations Teams
    January 20, 2026

Sign Up

Get notified when we post new content.

Thanks! Keep an eye out for new content!

  • Twitter
  • LinkedIn
©2026 SentinelOne, All Rights Reserved.