Show Notes
Most security teams know Windows inside out, but not macOS. Beacon by Jamf Threat Labs hunts the Mac malware and attacker activity your team misses.
In this episode of Jamf After Dark, hosts Kat Garbis and Josh Thornton talk with Jaron Bradley, Director of Jamf Threat Labs, about the state of the macOS threat landscape in 2026, and a new service that brings dedicated Mac threat hunting to your environment. If you run a Mac fleet and your team's expertise is mostly Windows or Linux, this one's for you.
What You'll Learn: - Why macOS is now a real target: info stealers, malicious search ads, and fake app installers - How Jamf Threat Labs researches malware like GhostClaw and builds detections into Jamf Protect - What Beacon is, how telemetry feeds the hunt, and why human analysts review every alert - Why dedicated macOS expertise matters when Windows-first tools fall short on Mac
CHAPTERS: 0:00 Mac Threats and the Jamf After Dark Crew 1:21 Meet Jaron Bradley: From Incident Response to macOS Threat Hunting 4:15 What Is Jamf Threat Labs? Team, Research and Mission 6:51 The State of the macOS Threat Landscape 7:33 Why Mac Is a Growing Target: Info Stealers and Malicious Ads 9:24 How AI Is Changing Both Attack and Defense 11:40 Jamf Threat Labs Research: GhostClaw, Predator and the Aftermath Tool 13:57 Jamf Protect and MI:RIAM: Real-Time Mac and Mobile Detection 14:43 How Attackers Masquerade Malware on macOS (DPRK Tactics) 17:21 Introducing Beacon by Jamf Threat Labs: What It Is and How It Works 19:37 Why Beacon Exists: macOS Threat Hunting as a Service 25:05 What to Expect as a Beacon Customer: Alerts, Detections and Reports 28:00 Real-World Story: Catching APT Activity on a Mac Fleet 29:25 How to Get Started with Beacon 30:47 Wrap-Up and Credits
🔔 Subscribe for more Apple security content from Jamf:
Who This Video Is For: - Endpoint security specialists and SecOps analysts responsible for macOS compliance and detection - Security stakeholders and CISOs building or scaling a Mac security program - IT and security teams whose strength is Windows or Linux but who now manage a growing Mac fleet
Resources Mentioned: - Beacon by Jamf Threat Labs: jamf.com/blog/beacon-jamf-threat-labs-mac-threat-hunting-service/ - Jamf Threat Labs: jamf.com/threat-labs/ - Jamf Protect: jamf.com/products/jamf-protect/ - Jamf Threat Labs on GhostClaw/GhostLoader: jamf.com/blog/ghostclaw-ghostloader-malware-github-repositories-ai-workflows/
Jamf After Dark is a podcast from Jamf. Reach us at [email protected] with the subject line "attention to the podcast."
#macsecurity #endpointsecurity #applesecurity #threatdetection #siem #endpointprotection #threathunting #Jamf
More from Jamf After Dark
AI-native workforce security is how Amplifier Security and Jamf close the gap between security policy and employee action, without slowing anyone down.
JNUC 2026 moved to September and runs Wednesday to Friday for the first time. The two people who organize it explain what else changed.
Travis County's Senior Systems Engineer explains why his team migrated 1,900+ Apple devices back to Jamf after trying a competing MDM, and how Jamf tools caught phishing test emails before users ever saw them.
One K12 school was blocking roughly 1,000 phishing attacks per day, and had no idea it was happening. EDU Buying season is here, and security, classroom tools, parent controls, and teacher adoption all need answers before a single device gets ordered.
Mobile device security is the biggest blind spot in most organizations, and most IT teams have no way to investigate when something goes wrong. Chris Deane, Senior Sales Engineer for Jamf Security Products, and Harry Jenkins, Senior Sales Manager for Jamf Mobile Forensics, sit down with hosts Kat Garbis and Josh Thornton to talk through what actually happens when a mobile device gets attacked. They cover the full picture: why MDM alone isn't security, how mobile threat defense stops most attacks but not all, and where Jamf Mobile Forensics comes in for the ones that slip through. Plus a deep dive into spyware — Pegasus (NSO Group), Predator (Intellexa), zero-click attacks, why journalists are targeted just as often as executives, and how Jamf Threat Labs builds detection rules for threats that have never been seen before. CHAPTERS: 0:00 Mobile devices are the #1 security blind spot 1:50 Meet the guests: Chris Deane and Harry Jenkins, Jamf Security 2:56 What makes Mobile Security different from endpoint security? 5:08 MDM, Mobile Threat Defense, and Mobile Forensics: the three layers explained 7:18 Why Only 15% of mobile devices are properly secured 9:49 Personal vs. Work: why the blurred lines make mobile security hard to enforce 15:36 Incident Response: what happens when an employee says their phone was attacked? 17:43 What Mobile Forensics actually means, and what Jamf is not looking at 19:57 iOS vs. Android CVEs: 90-120 Apple patches vs. 600-900 Android in 12 Months 22:43 Spyware: What Predator and Pegasus actually do to your mobile device 25:37 Targeted malvertising and the shift from One-Click to Zero-Click Attacks 29:07 Who gets targeted: executives, journalists, and travelers in High-Risk countries 33:20 How Jamf Threat Labs detects unknown threats using behavioral analysis 36:43 AI Analysis in Jamf Mobile Forensics: deeper insights without Forensic skills