SentinelLabs Logo RGB WhitePurp
ABOUT
CONTACT
VISIT SENTINELONE.COM

Phil Stokes

Phil Stokes is a Research Engineer at SentinelOne, specializing in macOS threat intelligence, platform vulnerabilities and malware analysis. He began his journey into macOS security as a software developer, creating end user troubleshooting and security tools just at the time when macOS adware and commodity malware first began appearing on the platform. Phil has been closely following the development of macOS threats as well as researching Mac software and OS vulnerabilities since 2014.
Defeating MacOS Malware Anti Analysis Tricks With Radare2 10
labs
Security Research

Defeating macOS Malware Anti-Analysis Tricks with Radare2

Phil Stokes / September 20, 2021

Learn how to beat malware authors' control flow and avoid executing unwanted parts of their code to analyze macOS malware in radare2.

Read More
sentinelone

The Good, the Bad and the Ugly in Cybersecurity – Week 37

The Good, the Bad and the Ugly | 5 minute read
Read More >
6 Pro Tricks For Rapid MacOS Malware Triage With Radare2 7
labs
Security Research

6 Pro Tricks for Rapid macOS Malware Triage with Radare2

Phil Stokes / August 30, 2021

Learn more about reversing real-world macOS malware in this new series for intermediate to advanced analysts, starting with these r2 tips!

Read More
sentinelone

The Good, the Bad and the Ugly in Cybersecurity – Week 35

The Good, the Bad and the Ugly | 5 minute read
Read More >
sentinelone

The Good, the Bad and the Ugly in Cybersecurity – Week 33

The Good, the Bad and the Ugly | 5 minute read
Read More >
Massive New AdLoad Campaign Goes Entirely Undetected By Apples XProtect 5
labs
Security Research

Massive New AdLoad Campaign Goes Entirely Undetected By Apple’s XProtect

Phil Stokes / August 11, 2021

Learn how to detect the latest variant of this widespread adware and browser hijacker, its infection pattern and indicators of compromise.

Read More
sentinelone

Detecting XLoader | A macOS ‘Malware-as-a-Service’ Info Stealer and Keylogger

macOS | 8 minute read
Read More >
sentinelone

The Good, the Bad and the Ugly in Cybersecurity – Week 30

The Good, the Bad and the Ugly | 5 minute read
Read More >
sentinelone

The Good, the Bad and the Ugly in Cybersecurity – Week 27

The Good, the Bad and the Ugly | 4 minute read
Read More >
Bypassing MacOS TCC User Privacy Protections By Accident And Design 8
labs
Security Research

Bypassing macOS TCC User Privacy Protections By Accident and Design

Phil Stokes / July 1, 2021

TCC is meant to protect user data from unauthorized access, but design flaws mean users and malware can bypass TCC, even by accident.

Read More
Previous
1 … 6 7 8 9 10 … 19
Next

SentinelLabs

In the era of interconnectivity, when markets, geographies, and jurisdictions merge in the melting pot of the digital domain, the perils of the threat ecosystem become unparalleled. Crimeware families achieve an unparalleled level of technical sophistication, APT groups are competing in fully-fledged cyber warfare, while once decentralized and scattered threat actors are forming adamant alliances of operating as elite corporate espionage teams.

Recent Posts

  • LABScon25 Replay | Hacktivism and War: A Clarifying Discussion
    LABScon25 Replay | Hacktivism and War: A Clarifying Discussion
    January 14, 2026
  • Inside the LLM | Understanding AI & the Mechanics of Modern Attacks
    Inside the LLM | Understanding AI & the Mechanics of Modern Attacks
    January 13, 2026
  • LLMs & Ransomware | An Operational Accelerator, Not a Revolution
    LLMs & Ransomware | An Operational Accelerator, Not a Revolution
    December 15, 2025

Sign Up

Get notified when we post new content.

Thanks! Keep an eye out for new content!

  • Twitter
  • LinkedIn
©2026 SentinelOne, All Rights Reserved.