Jamf Blog

Jamf Threat Labs discovers and investigates AmnesiaStealer, a multi-stage Rust-based macOS infostealer spread through a counterfeit GitHub download page that captures the login password, reaches for macOS bypasses Apple has already patched, and can hand the operator live, hidden control of the victim's Chromium browser to steal authenticated sessions.

Jamf Threat Labs have discovered a cluster of apps that are leaking sensitive information. Read on to learn more.

Jamf Threat Labs uncovers a macOS campaign using a fake Zoom installer to deploy Overlord RAT. Built with .NET, this cross-platform technique simultaneously targets Windows, joining Go- and Rust-based cross-platform malware.

Sophisticated mobile attack kits profile a device before exploiting it, and understanding those checks shows defenders how hardening a phone can make an attacker walk away.

Jamf Threat Labs analyzes Samsung kernel memory protections and bypass methods observed in the wild.

Jamf Threat Labs discovers and investigates CrashStealer, a C++ macOS infostealer that impersonates Apple's crash-reporting framework to harvest browser credentials, cryptocurrency wallets and keychain data, encrypting stolen files with AES-GCM before exfiltrating them to a remote command-and-control server.

Jamf Threat Labs investigates PamStealer, a macOS infostealer disguised as the legitimate Maccy clipboard manager that uses a two-stage attack chain to silently harvest data and clipboard contents while evading detection.

Beacon by Jamf Threat Labs is a threat hunting service for macOS environments. Get the full expertise of Jamf Threat Labs protecting your Mac fleet.