sysop_host (@sysop_host) header
sysop_host (@sysop_host) profile picture

sysop_host

@sysop_host

Hacker, security geek, climber, spanner monkey, and occasional builder of rally cars

 Australia
0x626c6f67.xyz/
Joined March 2009
  • Tweets14.7K
  • Following764
  • Followers768
368Media
Photo by sysop_host (@sysop_host)Photo by sysop_host (@sysop_host)Photo by sysop_host (@sysop_host)Photo by sysop_host (@sysop_host)Photo by sysop_host (@sysop_host)Photo by sysop_host (@sysop_host)Photo by sysop_host (@sysop_host)Photo by sysop_host (@sysop_host)Photo by sysop_host (@sysop_host)Photo by sysop_host (@sysop_host)
We've captured the malicious execution of the compromised Claude Code extension reported by Phorion. We're now turning the collected telemetry into a Hunt Lead so everyone can investigate the activity firsthand and hunt for the malicious behavior. We're working on it and will share an update as soon as it's ready! ✅ macOS telemetry ✅ Malicious artifacts ✅ Network traffic phorion.io/blog/offical-clau…
Official Claude Code Extension Compromise: Security Advisory | Phorion

Official Claude Code Extension Compromise: Security Advisory | Phorion

Phorion has detected a backdoor in the official Claude Code for VS Code extension bundle on Open VSX that drops a persistent SSH backdoor across macOS, Linux, and Windows. This write-up focuses …

phorion.io
2
6
1
13
3,279
sysop_host retweeted
Calum Hall (@_calumhall) profile picture
Calum Hall@_calumhallOct 30
Phorion just released our analysis of the Claude Code extension compromise, including how we detected it in the first place. Once again threat actors not fully understanding or testing their macOS malware seems to have bailed the industry out 🍎 phorion.io/blog/offical-clau…
Official Claude Code Extension Compromise: Security Advisory | Phorion

Official Claude Code Extension Compromise: Security Advisory | Phorion

Phorion has detected a backdoor in the official Claude Code for VS Code extension bundle on Open VSX that drops a persistent SSH backdoor across macOS, Linux, and Windows. This write-up focuses …

phorion.io
4
8
15
1,819
sysop_host retweeted
Luke Roberts (@rookuu_) profile picture
Luke Roberts@rookuu_Oct 30
The bug in the SSH backdoor code for macOS is likely a near miss for a bunch of Apple shops. However if you've got your Mac's setup with remote login and you use Claude Code, check for these IOCs ASAP as this is a nasty one...
Phorion (@PhorionTech) profile picturePhorion@PhorionTechOct 30
Phorion has discovered a compromise of the official Claude Code for VS Code extension (2.1.313) on Open VSX. Here is a breakdown of how the implant works, a bug in its macOS setup logic, and what to hunt for across your fleet. 🧵
Image from Phorion (@PhorionTech)
5
16
2
203
42,980
sysop_host retweeted
Phorion (@PhorionTech) profile picture
Phorion@PhorionTechOct 30
Phorion has discovered a compromise of the official Claude Code for VS Code extension (2.1.313) on Open VSX. Here is a breakdown of how the implant works, a bug in its macOS setup logic, and what to hunt for across your fleet. 🧵
Image from Phorion (@PhorionTech)
6
30
7
64
55,460
sysop_host retweeted
L0Psec (@L0Psec) profile picture
L0Psec@L0PsecOct 29
Got to talk about my favorite topic :)
Volexity (@Volexity) profile pictureVolexity
@VolexityOct 29
Replying to @Volexity @stevenadair
Next up is Christopher Lopez, covering the macOS threat landscape, from lures & recent malware families to the forensic artifacts that drive durable detections.
Image from Volexity (@Volexity)
4
22
848
sysop_host retweeted
Calum Hall (@_calumhall) profile picture
Calum Hall@_calumhallOct 21
The AI prompt collection we’ve introduced here is 🔥
Phorion (@PhorionTech) profile picturePhorion@PhorionTechOct 20
An AI agent uploaded internal files to Pastebin. You can see what happened, but do you know why it did it? Our latest post walks through how to use AI agent context during alert triage, even if your endpoint tooling doesn’t collect it for you. phorion.io/blog/ai-agent-tri…
Endpoint Security in the AI Age, Part II: Detection and Triage | Phorion

Endpoint Security in the AI Age, Part II: Detection and Triage | Phorion

This post looks at how agent attribution, collected session prompts and script content help analysts investigate AI-driven activity. We also cover tuning detections around common agent behaviour and …

phorion.io
1
1
138
sysop_host retweeted
Calum Hall (@_calumhall) profile picture
Calum Hall@_calumhallOct 14
If you’re a blue teamer this series is worth throwing some eyes on 👀 We’re seeing a complete shift in endpoint activity as a result of chaotic AI workloads. Short term the noise is rough for security teams - but it’s all about finding the visibility and controls to adapt.
Phorion (@PhorionTech) profile picturePhorion@PhorionTechOct 13
Part 1 of Phorion's Endpoint Security in the AI Age is here! AI agents are changing endpoint security. Alert fidelity is dropping, and traditional tuning isn’t keeping up. A new era calls for a new approach to defending endpoints. phorion.io/blog/ai-endpoint-…
Endpoint Security in the AI Age, Part I: Rethinking Detection Fidelity | Phorion

Endpoint Security in the AI Age, Part I: Rethinking Detection Fidelity | Phorion

AI is blurring the line between what users deliberately do and what software does on their behalf. As familiar patterns give way to unpredictable workflows, how do security teams tell normal activity...

phorion.io
1
1
341
TaskExplorer now natively integrates with Ollama 🤖 ...so you can bring your favorite local LLM to the party! Latest version available here: objective-see.org/products/t…
Image from Patrick Wardle (@patrickwardle)
Patrick Wardle (@patrickwardle) profile picturePatrick Wardle
@patrickwardleSep 16
I've just (re)written TaskExplorer Think Process Monitor but for macOS, open source, & much more powerful 💪🏽 Highlights: • CLI + JSON export • On-device AI assistant • Code signing + VirusTotal context • Live process/file/dylib/network activity objective-see.com/products/t…
Image from Patrick Wardle (@patrickwardle)
3
12
1
57
5,150
This ClickFix campaign targets macOS users. - press29[.]com is used to host the (2) shell scripts as well as the final payload. - render-6[.]com appears to be used for statistical purposes in the second script. The final payload is here: virustotal.com/gui/file/b123…
Jean-Baptiste (@jb_ma) profile pictureJean-Baptiste@jb_maAug 31
Je viens de tomber sur une tentative de hack la plus évoluée et vicieuse que j'ai vu. J'ai d'ailleurs failli me faire avoir Un faux CAPTCHA Cloudflare, extrêmement bien fait Décorticage de la technique. 🧵
Image from Jean-Baptiste (@jb_ma)
2
5
10
2,599
Always interesting to see how macOS malware is evolving, and what stays the same 📈🍎🐛 Solid report from @moonlock_com on macOS malware & threat trends from the first half of 2026.
Moonlock by MacPaw (@moonlock_com) profile pictureMoonlock by MacPaw
@moonlock_comAug 12
Replying to @moonlock_com
Want to go deeper? 🔎 Explore the full Moonlock Lab mid-2026 macOS Threat Report, including threat data, attack trends, and recommendations for Mac users and security teams: moonlock.com/mid-2026-macos-…
Mid-2026 macOS malware threat report

Mid-2026 macOS malware threat report

The risks, the lures, and how to stay safe.

moonlock.com
10
41
6,012
sysop_host retweeted
Wojciech Reguła (@_r3ggi) profile picture
Wojciech Reguła@_r3ggiJul 16
👾 New blog post about another macOS 27 privacy enhancement. Thx @ciphwall for a hint: wojciechregula.blog/post/gol…

Crossing the Golden Gate: macOS's New Application Support Protection

Summary Looks like moving the user’s TCC db to /private/var/containers/Data/ProtectedSystem/[UUID]/Data/Library/Application Support/com.apple.TCC/ was not the only change in the whole privacy castle...

wojciechregula.blog
2
15
45
3,790
#OBTS v9 is offering more macOS & iOS trainings than ever before! If you want to learn from the best (in sunny Hawaii), check them out:
Objective-See Foundation (@objective_see) profile pictureObjective-See Foundation@objective_seeMay 18
Replying to @objective_see
Stoked to announce the #OBTS v9 trainings 🥳 🔗 objectivebythesea.org/v9/tra… This year we’ve expanded to *six* trainings covering iOS & macOS: malware, threat hunting, reversing, vulnerability research, and more! 🍎🐛👾🔬🛡️ Trainings always sell out, so grab your spot today!
#OBTS v9.0: Trainings

#OBTS v9.0: Trainings

Learn from the top Apple security researchers in the world.

objectivebythesea.org
4
22
3,607
sysop_host retweeted
Csaba Fitzl (@theevilbit) profile picture
Csaba Fitzl
@theevilbitMay 18
Our macOS VR training is coming to OBTS!! 🤙☀️🏖️
Objective-See Foundation (@objective_see) profile pictureObjective-See Foundation@objective_seeMay 18
Replying to @objective_see @patrickwardle @jbradley89 @naehrdine @Helthydriver
6️⃣ "macOS Vulnerability Research" macosvuln.training/ Taught by @theevilbit and @gergely_kalman, this *new* training focuses on macOS vulnerability research (VR), with an emphasis on logic flaws and understanding Apple’s unique protections and attack surfaces.
MacOS Vulnerability Research Training

MacOS Vulnerability Research Training

Csaba Fitzl and Gergely Kalman's macOS vulnerability research training

macosvuln.training
7
35
5,699
30 days of DPRK activity on NPM. 108 packages, 261 versions and close to 700 indicators.
1
5
10
1,090
sysop_host retweeted
Calum Hall (@_calumhall) profile picture
Calum Hall@_calumhallApr 16
Hats off to Apple for bringing in some controls for ClickFix. But I'm pretty stoked with how Phorion builds on top of this at an enterprise level with our clipboard protection 🍎
Phorion (@PhorionTech) profile picturePhorion@PhorionTechApr 16
Apple has now acknowledged ClickFix as a serious threat. The new protections in 26.4 meaningfully raise the bar for the average user. 🙌 However, for enterprises and developers, we thought more can still be done. So we built Phorion's advanced Clipboard Protection. 🧵
Image from Phorion (@PhorionTech)
1
3
17
4,281
sysop_host retweeted
L0Psec (@L0Psec) profile picture
L0Psec@L0PsecMar 31
a lot of talk about the axios supply chain attack involving a macOS backdoor "WaveShaper" so thought it would be fun to do some old fashioned RE (like a dinosaur) youtube.com/watch?v=MfV56qPe… Not exhaustive and looked at it "live" so may be missing some details :)
NPM Axios - macOS Backdoor RE WaveShaper

NPM Axios - macOS Backdoor RE WaveShaper

There's a lot of conversations about the NPM Axios Supply Chain Att...

youtube.com
1
9
25
1,799
If you're looking for a framework to benchmark macOS EDR capabilities, checkout the latest update to the EDR Telemetry Project! 🍎 It is open-source and community-run. If you have access to an EDR, consider submitting a PR to rank its capabilities! @Kostastsale edr-telemetry.com/blog/macOS…
🤖 Made with AI
macOS EDR telemetry update

ALT macOS EDR telemetry update

1
9
35
4,296
sysop_host retweeted
Luke Roberts (@rookuu_) profile picture
Luke Roberts@rookuu_Mar 28
Playing with Apple’s latest ESF events took a little bit more work this time around! I’ve written up a post on exploring the new undocumented socket bind events or ES_EVENT_TYPE_RESERVED_3 and _4. phorion.io/blog/reverse-engi…
Reverse Engineering macOS 26.4's Undocumented Socket Bind Events | Phorion

Reverse Engineering macOS 26.4's Undocumented Socket Bind Events | Phorion

Apple’s macOS 26.4 introduced several undocumented Endpoint Security events. We reverse engineered ES_EVENT_TYPE_RESERVED_3 and _4 to reveal new socket bind visibility for security tools.

phorion.io
13
1
36
5,679
You can now build macOS firewalls/network tools via Endpoint Security - no Network Ext. needed! 🤯 Reversing macOS 24.6’s new ES_EVENT_TYPE_RESERVED_* ES events shows some are network auth/notify hooks Read: “Building a Firewall…via Endpoint Security!?” objective-see.org/blog/blog_…
Building a Firewall ...via Endpoint Security!?

Building a Firewall ...via Endpoint Security!?

Reverse Engineering macOS 26.4's Undocumented Network Events

objective-see.org
4
64
4
394
46,764
sysop_host retweeted
Calum Hall (@_calumhall) profile picture
Calum Hall@_calumhallMar 26
Awesome job from the Phorion team on the results of the EDR Telemetry Project 🚀 edr-telemetry.com/macos
Image from Calum Hall (@_calumhall)
1
9
42
5,843
Load more