🛠 🍎 👾 Objective-See'ing & DoubleYou'ing
Maui, HI
Joined October 2013
- Tweets10.7K
- Following998
- Followers41.7K
- Likes17.1K
Pinned Tweet
Stoked for the next (ad)venture: "DoubleYou" techcrunch.com/2024/04/25/ex…
Cofounded w/ long-time friend @hexlogic, we're empowering those building security tools for Apple devices 🍎🛡️
And by bootstrapping this venture, our core value of democratizing security remains our focus!
Patrick Wardle retweeted
🚀 I’ve launched App Scam DB — a new home for my investigations into scam apps and misleading App Store listings.
Some apps launch as generic tools, then change their names, icons and screenshots to borrow the identity of brands people trust — while pushing expensive weekly subscriptions.
🔎 I track those changes and examine developer identities, websites and pricing.
📸 Reports include original screenshots, before-and-after comparisons and downloadable evidence.
👥 Written for everyday users, not just security researchers.
Explore the reports 👇
appscamdb.com
Patrick Wardle retweeted
1/ We tore apart a #macOS C2 implant that's currently sailing past engines on VT - 0 detections as of today. Shared by @malwrhunterteam.
Written in Zig, and engineered like red-team infrastructure.
Here's what makes it interesting 👇
Patrick Wardle retweeted
#OBTS v9.0 is officially SOLD OUT! 🎉🌴
Registration is now closed, but if you're still hoping to join us in Maui, get on the waitlist!
📩 [email protected]
A few spots usually open up as the conference gets closer, so there's still a chance! 🤞
Patrick Wardle retweeted
We've also added a HeartBreaker sample and its metamorphic framework to our public macOS malware repository:
github.com/objective-see/Mal… (pw: infect3d)
#SharingIsCaring
Patrick Wardle retweeted
Our free, open-source tools, like RansomWhere?, use behavioral heuristics rather than signatures ...so metamorphose all you want! 😆
RansomWhere?
objective-see.org/products/r…
Patrick Wardle retweeted
It’s not every day we encounter metamorphic ransomware targeting macOS! 👀
Our @patrickwardle recently presented at @macsysadmin & @virusbtn on “Heartbreaker,” a new ransomware sample that rewrites & recompiles itself every time it runs!
Blog & slides: objective-see.org/blog/blog_…
Patrick Wardle retweeted
Join us and @Rippling for a happy hour in NYC on Nov. 11! 🥳
Connect with fellow IT & security pros over drinks & light bites, plus hear from @patrickwardle on hacking AI agents & assistants 🤖🔍
RSVP: luma.com/jm3p4qos
Patrick Wardle retweeted
🏝️ 🌺 🌊
Do you want to spend 3 days (or 6) in this location?
Do you have some year-end budget left that you need to spend?
Fear no more! We got you covered with @gergely_kalman !
Just come to our "macOS Vulnerability Researcher" training, which will be at Nov. 15th - 17th, in Maui, Hawaii.
Then stay for the conference.
➕ As a side effect: you will gain a ton of macOS knowledge with the likelihood that you will find some cool 0days after, and earn 💰
➕ ➕ Bonus: You will have a chance to meet some of the best minds of the macOS attack and defense space at the conf.
We only have a few spots left, so don't overthink it, just sign up.
More info here:
objectivebythesea.org/v9/tra…
Patrick Wardle retweeted
Calif’s Chollima jailbreak:
• Kernel r/w, SPTM bypass, sandbox escape
• iOS 27.0.1; demoed on MIE-enabled 17e & 18 Pro
• Unpatched 0-days: Duo could get a day-one untethered jailbreak
• Will get released at some point but no ETA
• Get your 18 Pro/PM on 27.0.1 or buy one now
Neat ChatGPT bug 🐛
Found manually (even after @OpenAI “pointed Astra at its own systems until it ran out of bugs")
Local (unpriv'd) attacker:
• Hijack your Dot
• Take over your account
• Access protected macOS files
+more 👀
@OpenAI's $500 bounty donated to @objective_see
Patrick Wardle retweeted
One week to go until VB2026! ❗
We’re officially into the final week, so if VB2026 is still in your plans, now’s the time to secure your ticket.
🇪🇸 14–16 October 2026 | Seville, Spain
🎟️ Get your ticket: tinyurl.com/ysdny5ae
#VB2026 #CyberSecurity #Seville #VBConference
TaskExplorer now natively integrates with Ollama 🤖
...so you can bring your favorite local LLM to the party!
Latest version available here:
objective-see.org/products/t…
I've just (re)written TaskExplorer
Think Process Monitor but for macOS, open source, & much more powerful 💪🏽
Highlights:
• CLI + JSON export
• On-device AI assistant
• Code signing + VirusTotal context
• Live process/file/dylib/network activity
objective-see.com/products/t…
Patrick Wardle retweeted
I read: "We will add more prompts or clicks to approve FDA". 🤯 The entire FDA thing should be redesigned from scratch, it's been always horrible and it just gets worse.
Patrick Wardle retweeted
Last week, our @patrickwardle spoke with @ThomasClaburn at @TheRegister about this exact issue: AI apps "undoing" Apple's hard work on security & privacy.
Great to see @Apple jumping into action to protect the security & privacy of its users.
Read: theregister.com/ai-and-ml/20…
Patrick Wardle retweeted
Those apps behave maliciously by any standards.
Yet Apple provides them in the App Store and notarises those delivered direct. Doesn't Apple accept any responsibility for approving them?
Smart way to limit AI agents! 👏
But, @Apple, please don't make Full Disk Access changes harder for macOS Endpoint Security tools!
They (per your design) require FDA plus a special entitlement you only grant after vetting, so please keep them easy for users to install! 🙏
Patrick Wardle retweeted
A fake Zoom installer found by #JamfThreatLabs hides a stolen macOS password inside a config file using invisible Unicode characters.
CloudSyncD uses that password once to launch a backdoor with elevated access. okt.to/SHA3m2
#CybersecurityAwarenessMonth
