EP30 The Golden Age of macOS Malware: Evolution, Stealers, and AI Workflows with Christopher Lopez
Behind the Binary by Google Cloud SecurityShow Notes
In this episode of Behind the Binary, we sit down with Mac security researcher Christopher Lopez (L0psec). to discuss the evolving landscape of macOS malware. As Mac adoption continues to grow in enterprise environments and among developers, threat actors are increasingly targeting the platform. Chris breaks down current attack vectors, starting with the rise of social engineering tactics like ClickFix, fake software downloads, and malvertising campaigns. They explore how infostealer fa...
More from Behind the Binary by Google Cloud Security
"Throwing more LLM prompts at a packed binary won’t make your analysis faster. But combining code similarity with AI will." In Episode 29 of Behind the Binary, Jonas Wagner and Endre Bangerter of ThreatRay join the podcast to lay out the real-world state of binary similarity in the LLM era. They demystify the current AI hype cycle, explaining why large language models are structurally unsuited for raw, unguided binary analysis, and how traditional binary similarity techniques are finding a ma...
In this episode, we're joined by security researcher Olivia Gallucci to explore macOS low-level security, kernel exploitation, and macOS threat trends. We break down how macOS internals differ from Linux—focusing on IOKit, C++ dynamic class resolution, and Vtable hijacking in kernel drivers. Olivia explains the mechanics behind use-after-free (UAF) vulnerabilities, heap shaping, and legacy kernel exploits, as well as modern Apple hardware and OS defenses like Pointer Authentication Codes (PAC...
When malware analysis first emerged, reverse engineers typically operated in a straightforward C landscape — standard Win32 APIs, no massive runtimes, and clear code paths. Today, the landscape has fundamentally shifted. The natural progression to C++ introduced object-oriented hurdles like virtual function tables and standard template library bloat, laying the groundwork for the complexities we see in today's modern ecosystem. In this episode of Behind the Binary, we sit down with Jae Young ...
Mobile security boundaries rely on isolating remote, untrusted inputs from highly privileged system components. However, when new automated features are introduced, the available attack surface can shift—sometimes exposing unexpected code paths to remote attackers. In the latest episode of Behind the Binary, we sit down with Seth Jenkins from Google Project Zero to dissect a full two-bug, zero-click exploitation chain targeting the Pixel 9. By chaining a user-space decoder flaw with a kernel ...
"TTD is a paradigm shift in the way you interact with the target... Potentially, five years from now, when we talk about debugging, we will just by default go to TTD." In this episode, we are joined by Xusheng Li, a debugger architect and reverse engineering expert, to explore the evolution of Time Travel Debugging (TTD). While traditional debugging has remained largely stagnant for decades, TTD introduces a novel new way to debug by recording and replaying execution traces with total precisi...