Author

Phil Stokes

Phil Stokes is a Research Engineer at SentinelOne, specializing in macOS threat intelligence, platform vulnerabilities and malware analysis. He began his journey into macOS security as a software developer, creating end user troubleshooting and security tools just at the time when macOS adware and commodity malware first began appearing on the platform. Phil has been closely following the development of macOS threats as well as researching Mac software and OS vulnerabilities since 2014.

Keep up with the latest

Blog posts by Phil Stokes

From the Front Lines
May 18, 2026
SHub Reaper | macOS Stealer Spoofs Apple, Google, and Microsoft in a Single Attack Chain
From the Front Lines
Jul 10, 2025
macOS.ZuRu Resurfaces | Modified Khepri C2 Hides Inside Doctored Termius App
From the Front Lines
Mar 25, 2025
ReaderUpdate Reforged | Melting Pot of macOS Malware Adds Go to Crystal, Nim and Rust Variants
From the Front Lines
Feb 3, 2025
macOS FlexibleFerret | Further Variants of DPRK Malware Family Unearthed
From the Front Lines
Jan 20, 2025
2024 macOS Malware Review | Infostealers, Backdoors, and APT Campaigns Targeting the Enterprise
From the Front Lines
Oct 22, 2024
macOS NotLockBit | Evolving Ransomware Samples Suggest a Threat Actor Sharpening Its Tools
macOS
Sep 17, 2024
macOS Sequoia | What’s New in Privacy and Security for Enterprise?
From the Front Lines
Sep 12, 2024
From Amos to Poseidon | A SOC Team’s Guide to Detecting macOS Atomic Stealers 2024
From the Front Lines
May 9, 2024
macOS Cuckoo Stealer | Ensuring Detection and Defense as New Samples Rapidly Emerge
From the Front Lines
May 1, 2024
macOS Adload | Prolific Adware Pivots Just Days After Apple’s XProtect Clampdown
From the Front Lines
Feb 1, 2024
Backdoor Activator Malware Running Rife Through Torrents of macOS Apps
From the Front Lines
Jan 15, 2024
The Many Faces of Undetected macOS InfoStealers | KeySteal, Atomic & CherryPie Continue to Adapt

Phil Stokes

Blog posts by Phil Stokes

SHub Reaper | macOS Stealer Spoofs Apple, Google, and Microsoft in a Single Attack Chain

macOS.ZuRu Resurfaces | Modified Khepri C2 Hides Inside Doctored Termius App

ReaderUpdate Reforged | Melting Pot of macOS Malware Adds Go to Crystal, Nim and Rust Variants

macOS FlexibleFerret | Further Variants of DPRK Malware Family Unearthed

2024 macOS Malware Review | Infostealers, Backdoors, and APT Campaigns Targeting the Enterprise

macOS NotLockBit | Evolving Ransomware Samples Suggest a Threat Actor Sharpening Its Tools

macOS Sequoia | What’s New in Privacy and Security for Enterprise?

From Amos to Poseidon | A SOC Team’s Guide to Detecting macOS Atomic Stealers 2024

macOS Cuckoo Stealer | Ensuring Detection and Defense as New Samples Rapidly Emerge

macOS Adload | Prolific Adware Pivots Just Days After Apple’s XProtect Clampdown

Backdoor Activator Malware Running Rife Through Torrents of macOS Apps

The Many Faces of Undetected macOS InfoStealers | KeySteal, Atomic & CherryPie Continue to Adapt