SentinelLabs Logo RGB WhitePurp
ABOUT
CONTACT
VISIT SENTINELONE.COM

Phil Stokes

Phil Stokes is a Research Engineer at SentinelOne, specializing in macOS threat intelligence, platform vulnerabilities and malware analysis. He began his journey into macOS security as a software developer, creating end user troubleshooting and security tools just at the time when macOS adware and commodity malware first began appearing on the platform. Phil has been closely following the development of macOS threats as well as researching Mac software and OS vulnerabilities since 2014.
Radare2 Power Ups Delivering Faster MacOS Malware Analysis With R2 Customization 5
labs
Security Research

Radare2 Power Ups | Delivering Faster macOS Malware Analysis With r2 Customization

Phil Stokes / May 31, 2023

Learn how to customize radare2 with user-defined aliases, macros and functions for faster and easier binary diffing and analysis.

Read More
Geacon Brings Cobalt Strike Capabilities To MacOS Threat Actors 1
labs

Geacon Brings Cobalt Strike Capabilities to macOS Threat Actors

Phil Stokes & Dinesh Devadoss / May 15, 2023

An uptick in malicious macOS payloads contain Cobalt Strike Beacons written in Go and derived from a Chinese open-source repository.

Read More
MacOS Malware Sold On Telegram Targets New Audience On Youtube 1
labs

Atomic Stealer | Threat Actor Spawns Second Variant of macOS Malware Sold on Telegram

Phil Stokes / May 3, 2023

A macOS infostealer being sold on Telegram, Atomic Stealer has a second variant that appears primed to target users directly on YouTube.

Read More
LockBit For Mac How Real Is The Risk Of MacOS Ransomware 6
labs

LockBit Ransomware: Protect Your macOS Today

Phil Stokes / April 18, 2023

Discovery of a macOS variant of LockBit has caused alarm, but how serious a threat is it? We explore the malware and the threat of ransomware on Apple Macs.

Read More
Session Cookies Keychains SSH Keys And More 7 Kinds Of Data Malware Steals From MacOS Users 8
labs

Session Cookies, Keychains, SSH Keys and More | 7 Kinds of Data Malware Steals from macOS Users

Phil Stokes / March 22, 2023

Stealing data from Mac devices can unlock the door for both financially-motivated cybercrime and espionage. Learn how recent macOS malware does it.

Read More
Hunting For Honkbox Multistage MacOS Cryptominer May Still Be Hiding 1
labs

Hunting for Honkbox | Multistage macOS Cryptominer May Still Be Hiding

Phil Stokes / March 1, 2023

A cryptominer that uses the Invisible Internet protocol, Honkbox variants could still be evading some detection solutions.

Read More
MacOS Payloads 7 Prevalent And Emerging Obfuscation Techniques 7
labs

macOS Payloads | 7 Prevalent and Emerging Obfuscation Techniques

Phil Stokes / January 30, 2023

Get a closer look at the payloads threat actors use to deliver malware on macOS from hidden scripts to Go binaries and obfuscated Cobalt Strike.

Read More
7 Ways Threat Actors Deliver MacOS Malware In The Enterprise 1
labs

7 Ways Threat Actors Deliver macOS Malware in the Enterprise

Phil Stokes / January 9, 2023

Stay ahead of the game with our review on macOS malware threats. Learn about the top techniques used by threat actors to deliver malware and how to build more resilient defenses.

Read More
Top 10 MacOS Malware Discoveries In 2022 3
labs

Top 10 macOS Malware Discoveries in 2022

Phil Stokes / December 7, 2022

Learn about all the new malware targeting macOS users in 2022 and how to stay safe from the latest Mac-focused campaigns.

Read More
V For Ventura How Will Upgrading To MacOS 13 Impact Organizations 2
labs

V for Ventura | How Will Upgrading to macOS 13 Impact Organizations?

Phil Stokes / October 26, 2022

macOS 13 Ventura has arrived! Read about the broader impacts of upgrading to macOS 13 on users, admins, and security teams.

Read More
Previous
1 … 3 4 5 6 7 … 20
Next

SentinelLabs

In the era of interconnectivity, when markets, geographies, and jurisdictions merge in the melting pot of the digital domain, the perils of the threat ecosystem become unparalleled. Crimeware families achieve an unparalleled level of technical sophistication, APT groups are competing in fully-fledged cyber warfare, while once decentralized and scattered threat actors are forming adamant alliances of operating as elite corporate espionage teams.

Recent Posts

  • Building an Adversarial Consensus Engine | Multi-Agent LLMs for Automated Malware Analysis
    Building an Adversarial Consensus Engine | Multi-Agent LLMs for Automated Malware Analysis
    March 19, 2026
  • LABScon25 Replay | Your Apps May Be Gone, But the Hackers Made $9 Billion and They’re Still Here
    LABScon25 Replay | Your Apps May Be Gone, But the Hackers Made $9 Billion and They’re Still Here
    March 17, 2026
  • From Narrative to Knowledge Graph | LLM-Driven Information Extraction in Cyber Threat Intelligence
    From Narrative to Knowledge Graph | LLM-Driven Information Extraction in Cyber Threat Intelligence
    March 9, 2026

Sign Up

Get notified when we post new content.

Thanks! Keep an eye out for new content!

  • Twitter
  • LinkedIn
©2026 SentinelOne, All Rights Reserved.