Labs Home

Author

Phil Stokes

Phil Stokes is a Research Engineer at SentinelOne, specializing in macOS threat intelligence, platform vulnerabilities and malware analysis. He began his journey into macOS security as a software developer, creating end user troubleshooting and security tools just at the time when macOS adware and commodity malware first began appearing on the platform. Phil has been closely following the development of macOS threats as well as researching Mac software and OS vulnerabilities since 2014.

Phil Stokes
  • macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox
    Adversary
    Phil StokesJun 23, 2026

    macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox

  • Building an Adversarial Consensus Engine | Multi-Agent LLMs for Automated Malware Analysis
    AI Research
    Phil StokesMar 19, 2026

    Building an Adversarial Consensus Engine | Multi-Agent LLMs for Automated Malware Analysis

  • Inside the LLM | Understanding AI & the Mechanics of Modern Attacks
    AI Research
    Phil StokesJan 13, 2026

    Inside the LLM | Understanding AI & the Mechanics of Modern Attacks

  • macOS NimDoor | DPRK Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware
    Advanced Persistent Threat
    Phil StokesJul 2, 2025

    macOS NimDoor | DPRK Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware

  • BlueNoroff Hidden Risk | Threat Actor Targets Macs with Fake Crypto News and Novel Persistence
    Advanced Persistent Threat
    Raffaele SabatoNov 7, 2024

    BlueNoroff Hidden Risk | Threat Actor Targets Macs with Fake Crypto News and Novel Persistence

  • 11 Ways to Tweak radare2 for Faster and Easier macOS Malware Analysis
    Security Research
    Phil StokesOct 31, 2023

    11 Ways to Tweak radare2 for Faster and Easier macOS Malware Analysis

  • Bloated Binaries | How to Detect and Analyze Large macOS Malware Files
    Security Research
    Phil StokesAug 29, 2023

    Bloated Binaries | How to Detect and Analyze Large macOS Malware Files

  • Automating String Decryption and Other Reverse Engineering Tasks in radare2 With r2pipe
    Security Research
    Phil StokesJun 21, 2023

    Automating String Decryption and Other Reverse Engineering Tasks in radare2 With r2pipe

  • Radare2 Power Ups | Delivering Faster macOS Malware Analysis With r2 Customization
    Security Research
    Phil StokesMay 31, 2023

    Radare2 Power Ups | Delivering Faster macOS Malware Analysis With r2 Customization

  • Use of Obfuscated Beacons in ‘pymafka’ Supply Chain Attack Signals a New Trend in macOS Attack TTPs
    Security & Intelligence
    Phil StokesMay 25, 2022

    Use of Obfuscated Beacons in ‘pymafka’ Supply Chain Attack Signals a New Trend in macOS Attack TTPs

  • The Art and Science of macOS Malware Hunting with radare2 | Leveraging Xrefs, YARA and Zignatures
    Security Research
    Phil StokesMar 21, 2022

    The Art and Science of macOS Malware Hunting with radare2 | Leveraging Xrefs, YARA and Zignatures

  • A Threat Hunter’s Guide to the Mac’s Most Prevalent Adware Infections 2022
    Security & Intelligence
    Phil StokesJan 4, 2022

    A Threat Hunter’s Guide to the Mac’s Most Prevalent Adware Infections 2022