Labs Home

Author

Phil Stokes

Phil Stokes is a Research Engineer at SentinelOne, specializing in macOS threat intelligence, platform vulnerabilities and malware analysis. He began his journey into macOS security as a software developer, creating end user troubleshooting and security tools just at the time when macOS adware and commodity malware first began appearing on the platform. Phil has been closely following the development of macOS threats as well as researching Mac software and OS vulnerabilities since 2014.

Phil Stokes
  • Infect If Needed | A Deeper Dive Into Targeted Backdoor macOS.Macma
    Security Research
    Phil StokesNov 15, 2021

    Infect If Needed | A Deeper Dive Into Targeted Backdoor macOS.Macma

  • Techniques for String Decryption in macOS Malware with Radare2
    Security Research
    Phil StokesOct 12, 2021

    Techniques for String Decryption in macOS Malware with Radare2

  • Defeating macOS Malware Anti-Analysis Tricks with Radare2
    Security Research
    Phil StokesSep 20, 2021

    Defeating macOS Malware Anti-Analysis Tricks with Radare2

  • 6 Pro Tricks for Rapid macOS Malware Triage with Radare2
    Security Research
    Phil StokesAug 31, 2021

    6 Pro Tricks for Rapid macOS Malware Triage with Radare2

  • Massive New AdLoad Campaign Goes Entirely Undetected By Apple’s XProtect
    Security Research
    Phil StokesAug 11, 2021

    Massive New AdLoad Campaign Goes Entirely Undetected By Apple’s XProtect

  • Bypassing macOS TCC User Privacy Protections By Accident and Design
    Security Research
    Phil StokesJul 1, 2021

    Bypassing macOS TCC User Privacy Protections By Accident and Design

  • New macOS Malware XcodeSpy Targets Xcode Developers with EggShell Backdoor
    Security & Intelligence
    Phil StokesMar 18, 2021

    New macOS Malware XcodeSpy Targets Xcode Developers with EggShell Backdoor

  • 20 Common Tools & Techniques Used by macOS Threat Actors & Malware
    Security Research
    Phil StokesFeb 16, 2021

    20 Common Tools & Techniques Used by macOS Threat Actors & Malware

  • FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts
    Security Research
    Phil StokesJan 11, 2021

    FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts

  • APT32 Multi-stage macOS Trojan Innovates on Crimeware Scripting Technique
    Adversary
    Phil StokesDec 3, 2020

    APT32 Multi-stage macOS Trojan Innovates on Crimeware Scripting Technique

  • Resourceful macOS Malware Hides in Named Fork
    Security Research
    Phil StokesNov 6, 2020

    Resourceful macOS Malware Hides in Named Fork

  • Privilege Escalation | macOS Malware & The Path to Root Part 1
    Security Research
    Phil StokesNov 6, 2019

    Privilege Escalation | macOS Malware & The Path to Root Part 1