Log inSign up
L0Psec
3,104 posts
L0Psec profile banner
@L0Psec

L0Psec

@L0Psec
reverse engineer | arm64 :) | macOS/iOS | YouTube: youtube.com/@l0psec
NC
l0psec.github.io/Malware_RE_Blo…
Joined October 2017
1,842
Following
3,766
Followers
RepliesRepliesRepostsRepostsMediaMedia

Log in or sign up for X

See what’s happening and join the conversation

Continue with phone
or
Log in with username or email
Terms·Privacy·Cookies·Accessibility·Ads Info·© 2026 X Corp.
  • Pinned
    @L0Psec
    L0Psec
    @L0Psec
    Jan 5
    My new site for learning macOS malware reverse engineering: l0psec.github.io/Malware_RE_Blo… I got my start in RE by using @patrickwardle's awesome blog. I would download samples and follow along. So I created this to complement that with dives into specific code from recent samples.
    l0psec.github.io
    Malware Minutes
    8
  • @L0Psec
    L0Psec
    @L0Psec
    Aug 20
    Quick look at the rust mach-O referenced in the blog post: 74d3447e7cf99c99ea01a16332ec27432dfb0f491e10e67cd118065a60483306. (0 VT hits currently) The RSA key with "I am botking" and the LaunchAgent plist (most of it) are both readable in const
    Image
    @ramimacisabird
    Rami McCarthy
    Wiz
    @ramimacisabird
    Aug 20
    In case you missed it, the spree of supply chain attacks visited Rust, hitting arrayref (245+ million downloads all time) Our Threat Center Advisory went out to customers a while ago. I wasn't going to blog ... and then we saw the DPRK connection 🇰🇵🤜🦀wiz.io/blog/rust-supp…
  • @L0Psec
    L0Psec
    @L0Psec
    Aug 19
    quick one: Curls out to quest-22\.com and grabs an ugly obfuscated zsh script that leads to an eval() call for another curl to download a mach-O binary: 0c97facc5bd1d43bca5293e9cc5836419666060a9f2f18f40898c52d4dc375a0.
    Image
    @skocherhan
    ܛܔܔܔܛܔܛܔܛ
    @skocherhan
    Aug 19
    Image
    1
  • @L0Psec
    L0Psec
    @L0Psec
    Aug 18
    Another macOS JXA loader. This time for Nancy clipboard seen at nancyclipboard\.com. When you attempt to download the DMG it does give you a warning on Safari, so that's good :) c4d8131276e43961e9460e5e6735bc718afd9d9e6eaefeab476cc042c5c38635 - DMG
    Image
    Image
    2
  • @L0Psec
    L0Psec
    @L0Psec
    Aug 13
    Looks like new threat notifications went out. A lot of great details in this thread by @jsrailton.
    @jsrailton
    John Scott-Railton
    @jsrailton
    Aug 13
    ALERT: Did you get a notification like this today? Seek expert security help asap! Apple just sent out a fresh round of threat notifications about mercenary spyware. That means tech like Pegasus used by governments to spy on you. Here are steps to take right now 1/
    Image
Advertisement
Advertisement