SentinelLabs Logo RGB WhitePurp
ABOUT
CONTACT
VISIT SENTINELONE.COM

Phil Stokes

Phil Stokes is a Research Engineer at SentinelOne, specializing in macOS threat intelligence, platform vulnerabilities and malware analysis. He began his journey into macOS security as a software developer, creating end user troubleshooting and security tools just at the time when macOS adware and commodity malware first began appearing on the platform. Phil has been closely following the development of macOS threats as well as researching Mac software and OS vulnerabilities since 2014.
XCSSET Malware Update Threat Actors Prepare For Life Without Python 4
labs

XCSSET Malware Update | macOS Threat Actors Prepare for Life Without Python

Phil Stokes & Dinesh Devadoss / August 22, 2022

New domains and new behavioral indicators, but malware authors stick to tried and tested architecture despite Apple’s updates.

Read More
From The Front Lines New MacOS Covid Malware Masquerades As Apple Wears Face Of APT 11
labs

From the Front Lines | New macOS ‘covid’ Malware Masquerades as Apple, Wears Face of APT

Phil Stokes & Dinesh Devadoss / July 6, 2022

A fake VPN delivers a Sliver implant with a further malicious payload. APT or Red Team? The IoCs can look the same to defenders.

Read More
Apples MacOS Ventura 7 New Security Changes To Be Aware Of 5
labs

Apple’s macOS Ventura | 7 New Security Changes to Be Aware Of

Phil Stokes / June 10, 2022

With macOS 13, Apple have made some bold and potentially disruptive changes to Mac security. We explore them here.

Read More
Use Of Obfuscated Beacons In ‘pymafka Supply Chain Attack Signals A New Trend In MacOS Attack TTPs 1
labs
Security & Intelligence

Use of Obfuscated Beacons in ‘pymafka’ Supply Chain Attack Signals a New Trend in macOS Attack TTPs

Phil Stokes / May 25, 2022

A new typosquatting attack against the PyPI repository targets enterprise Macs with a distinctive obfuscation method.

Read More
The Art And Science Of MacOS Malware Hunting With Radare2 Leveraging Xrefs YARA Zignatures 11
labs
Security Research

The Art and Science of macOS Malware Hunting with radare2 | Leveraging Xrefs, YARA and Zignatures

Phil Stokes / March 21, 2022

In the next part of our series on reversing macOS malware, we dig into identifying reused code across malware samples for hunting and detection.

Read More
New GBU Weekly
labs

The Good, the Bad and the Ugly in Cybersecurity – Week 6

Phil Stokes / February 11, 2022

Russian cops take down 4 notorious darknet markets, hackers breach 500 online stores, and APTs plant fake evidence to incriminate civil rights activists.

Read More
Why Everything You Thought You Knew About MacOS Security Is Wrong 1
labs

10 Assumptions About macOS Security That Put Your Business At Risk

Phil Stokes / February 7, 2022

Keep your macOS devices safe by learning how to avoid the most common security risks from malware, adware, lack of visibility and more.

Read More
Sneaky Spies And Backdoor RATs SysJoker And DazzleSpy Malware Target MacOS 4
labs

How SysJoker and DazzleSpy Malware Target macOS

Phil Stokes / February 1, 2022

Targeting macOS users with cross-platform malware and leveraging OS vulnerabilities, threat actors begin 2022 by continuing the trends we saw last year.

Read More
New GBU Weekly
labs

The Good, the Bad and the Ugly in Cybersecurity – Week 4

Phil Stokes / January 28, 2022

DeepDotNet owner gets 8 years in jail, Conti and Deadbolt ransomware hit big & small targets alike, and new ITW malware and exploits strike Apple platforms.

Read More
New GBU Weekly
labs

The Good, the Bad and the Ugly in Cybersecurity – Week 2

Phil Stokes / January 14, 2022

Cops bust crimeware gang in Kyiv, Texas firm bankrupt after paying ransom but getting no data returned, and MS Defender has simple bypass known for 8 years.

Read More
Previous
1 … 4 5 6 7 8 … 20
Next

SentinelLabs

In the era of interconnectivity, when markets, geographies, and jurisdictions merge in the melting pot of the digital domain, the perils of the threat ecosystem become unparalleled. Crimeware families achieve an unparalleled level of technical sophistication, APT groups are competing in fully-fledged cyber warfare, while once decentralized and scattered threat actors are forming adamant alliances of operating as elite corporate espionage teams.

Recent Posts

  • From Narrative to Knowledge Graph | LLM-Driven Information Extraction in Cyber Threat Intelligence
    From Narrative to Knowledge Graph | LLM-Driven Information Extraction in Cyber Threat Intelligence
    March 9, 2026
  • Silent Brothers | Ollama Hosts Form Anonymous AI Network Beyond Platform Guardrails
    Silent Brothers | Ollama Hosts Form Anonymous AI Network Beyond Platform Guardrails
    January 29, 2026
  • LABScon25 Replay | How to Bug Hotel Rooms v2.0
    LABScon25 Replay | How to Bug Hotel Rooms v2.0
    January 21, 2026

Sign Up

Get notified when we post new content.

Thanks! Keep an eye out for new content!

  • Twitter
  • LinkedIn
©2026 SentinelOne, All Rights Reserved.