Principal @HuntressLabs | Former Detection & Response Principal @CrowdStrike | macOS Security Enthusiast
Australia
Joined May 2024
- Tweets235
- Following107
- Followers626
- Likes362
Ryan Dowd retweeted
Appreciate @jstrosch for the invite on the podcast! macOS malware is at an interesting place. Also, getting to talk about how reverse engineering workflows are changing with AI was fun/therapeutic. I wasn’t crying I promise. 😂
New episode of Behind the Binary is live!
🎙️Joined by @L0Psec to break down macOS security, ClickFix social engineering, InfoStealers (AMOS/MacSync), DPRK developer targeting, and the evolution of obfuscation.
Plus, we talk about how AI is shifting reverse engineering and the inevitable future state...
🎧 podcasts.apple.com/us/podcas…
Ryan Dowd retweeted
🍎🐛 I got Claude making this, maybe it's useful for others as well.
Every Apple security advisory since 2002 - parsed, indexed, charted. With links to writeups, POCs and presentations.
apple-cve.com/
Ryan Dowd retweeted
Apple just announced big changes to Full Disk Access in macOS!
When will it ship?
What will the new approval look like?
Will existing FDA approvals be affected?
What about existing MDM/PPPC profiles?
Will enterprise & security tools get different treatment from AI or other apps?
Ryan Dowd retweeted
CVE-2026-100754: ChatGPT's code-signing checks on macOS/Windows can be bypassed by (local, unprivileged) attackers, who then inherits the agent's trust:
💉 Inject prompts
👀 Read private chats
🔓 Access TCC-protected files
🍪 Steal cookies/auth tokens/browsing sessions
Security & privacy used to mean fighting malware and hackers
...now, we have to add "AI agents" to that threat model 🤖 😅
Mahalo to the @nytimes for spotlighting some of our recent ChatGPT research & bugs!
nytimes.com/2026/09/29/techn…
Ryan Dowd retweeted
Reminder: 🍎-security tools subscribing to ES AUTH_* events must respond before an ES deadline (~15s) or the kernel kills them ...& they stay ☠️
Privileged attacker? SIGSTOP the tool ...⏳💥😂
Mitigation (per @PeteMarkowsky) subscribe to/block signals!
docs.google.com/presentation…
Ryan Dowd retweeted
Come join our training in Budapest! As it stands we will be able to spend some quality time with the trainees, so if that's your jam there's still room left!
Our next training with @gergely_kalman will be in Budapest between the 12th and 15th of October. This is our only training in Europe for this year, and this is the only time we will teach the 4 day version of the training.
If you are looking getting into Apple vuln research then this is Your training. Although we don't do iOS here, many of the concepts we teach are applicable there as well.
macosvuln.training/
Ryan Dowd retweeted
Thrilled to announce I will be speaking in Sydney!
Hope to catch some of you out at @UnpromptedAU
Ok! The schedule is live as! Check it out: unprompted.au
![[un]prompted.au — AI × Cybersecurity Conference · Sydney, 18–19 September 2026](https://pbs.twimg.com/card_img/2115756261773873152/elRTN6Oy?format=jpg&name=800x419)
Ryan Dowd retweeted
#PamStealer macOS infostealer · new JXA loader 🧐
🎭 fake CleanDev clones DevCleaner → cleandev[.]cc
⛓️ one char-code .js = whole kill-chain:
🎣 ClickFix → curl → osascript
🧬 self-decodes at runtime · Function('return') 👇 img
🕵️ gauntlet first → anti-VM · ptrace · SIP · CIS ×11
🔑 then RC4 → C2, env-keyed (cracked offline 🤷♂️)
📥 only now → stage-2 Mach-O
🥸 fake Finder[.app (real .icns) → com[.apple.finder.agent
🎬 fake "Installation failed" = already infected
📡 notification-portal[.]com
🎯 catch by @ValeryMarchive
Ryan Dowd retweeted
This was interesting. I hadn't seen Google Docs weaponized like that before.
@_rdowd @JSemonSecurity and @threatresearch spent some time hunting everything down and it turned out a little more interesting than I previously thought.
We never got that linux lure though 🤣
huntress.com/blog/defcon-phi…
Ryan Dowd retweeted
My last scan shown around 40k open screen sharing hosts on the internet, almost half in the US, most are residential IPs but there are many juicy hosts in Murican universities, some companies, a server from BBEdit company. Party hard, never expose those services unless behind ssh
Ryan Dowd retweeted
Apple’s latest macOS update addresses two Screen Sharing vulnerabilities, including one enabling pre-authenticated remote code execution.
Huntress recommends all macOS users update systems immediately.
@_rdowd shares detection details and more: okt.to/fW1KFu
Ryan Dowd retweeted
Bugtraq Is Back: The Original Full Disclosure Mailing List Is Live Again 👹👹👹 #Defcon34 #Bugtraq #FullDisclosure @defcon @vxunderground @troyhunt @thegrugq @solardiz @thedarktangent @richinseattle @phrack @bsdaemon @nudehaberdasher @chompie1337 @schneierblog @halvarflake @gadievron @robertgraham
securityledger.com/2026/08/b…
ALT Bugtraq is Back !
Ryan Dowd retweeted
macOS 27.0 Beta (26A5388g was what I looked at) has some new changes for endpoint security I thought worth sharing.
Two new event types: bootstrap_check_in and bootstrap_look_up.
Both AUTH + NOTIFY. ES_EVENT_TYPE_LAST effectively goes from 157 to 162.
Submitter is launchd, not the usual libEndpointSecuritySystem.dylib path!
And it goes through a new ES policy syscall:
launchd (___mac_syscall)
-> es::EndpointSecurityEventManager::es_policy_syscall(proc*, int, uint64_t)
---> sendBootstrapLookUp / sendBootstrapCheckIn
---> sendAuthAndNotify<es_auth_result_t, ...>
---> any clients with the with the com.apple.private.endpoint-security.submit.bootstrap entitlement
Now clients can allow/deny a process's Mach/XPC bootstrap look-up before launchd completes it, or just observe check-ins (as seen with managedeventsd is now becoming a full MDM launch-restriction enforcer, see 3/3).
Ryan Dowd retweeted
the LLM cl0wns wasted no time tearing apart navi_the_clown and prepared some fresh sl0p for your weekend, enjoy! 🤡🤖🦾 warez.sl0p.foo/apple-screens…
The screensharingd bug is a pre-auth, and an amazing bug that LLM enabled clowns killed without understanding it. Releasing a PoC that allows to download files from vulnerable macOS. It’s not super reliable, but the real one is very much. Patch asap!
reverse.put.as/2026/07/29/it…
Ryan Dowd retweeted
One of the most time consuming parts of macOS research is identifying what you're looking at - AMOS, NovaStealer, DigitStealer, MacSync, or maybe Shlayer or Adload.
You can now pull in this Malware Research skill to help you classify malware quickly.
blog.crashsecurity.io/macos-…
