SHOW NOTES

In this episode of SecOps Weekly, Phil Hagen and Tony Lambert discuss the evolving landscape of macOS malware. The presenters debunk the myth that Macs are immune to viruses, citing statistics that show increased activity from threats like MacSync Stealer and Phexia. They explore technical delivery methods, including the use of ClickFix for social engineering tactics and AppleScript for fileless execution. The discussion covers detection strategies via EDR and the use of Apple’s Endpoint Security Framework, as well as prevention methods like the open-source Santa application control tool. The episode concludes with advice on managing Mac fleets within an enterprise environment.

TIMESTAMPS

• 00:00: Welcome to SecOps Weekly!
• 01:58: The myth
• 03:19: Top Mac malware threats
• 07:10: A look at Phexia
• 12:20: What can defenders do about Mac malware?
• 27:04: The obfuscation evolution