Think your Mac is the safe corner of the network? Olivia Gallucci joins Pedro Kertzman to dismantle the myth of “secure by default” and show how modern attackers slip past comfort-zone defenses. We dig into the real blind spots on macOS, why unified logging and strict entitlements complicate endpoint visibility, and how Apple’s Endpoint Security API helps—while still leaving gaps clever adversaries can exploit.Olivia walks us through the rise of living-off-the-land tactics on Mac, often called LOLBins, where trusted tools like osascript, curl, launchctl, bash, and dscl become covert malware helpers. Instead of fixating on blocklists, we explore behavior-based detections that catch suspicious parent-child process chains, stealthy downloads, and persistence via launch agents. We also trace the expanding attack surface created by enterprise adoption of Macs among developers, admins, and executives—users with access, keys, and data worth chasing.On the supply chain front, we unpack how developers get targeted through poisoned dependencies and compromised package ecosystems, with examples tied to CocoaPods issues and malicious packages pulling command-and-control frameworks. For end users, trojanized apps, shady installers, and macro-laced documents still work, and notarization alone isn’t a silver bullet. Olivia shares pragmatic safeguards: dependency pinning, signed builds, stricter MDM policies, and layered monitoring that blends Apple-native frameworks with network telemetry. To help users help themselves, she highlights Objective-See’s open source tools that flag camera, microphone, and persistence changes in plain language.If you care about macOS security beyond the brochure, this conversation maps the terrain—what’s visible, what isn’t, and how to build defenses that hold up when trust fails. Subscribe, share with a teammate who uses a Mac at work, and leave a review with the one Mac detection you wish you had today.Send a textSupport the showThanks for tuning in! If you found this episode valuable, don’t forget to subscribe, share, and leave a review. Got thoughts or questions? Connect with us on our LinkedIn Group: Cyber Threat Intelligence Podcast—we’d love to hear from you. If you know anyone with CTI expertise that would like to be interviewed in the show, just let us know. Until next time, stay sharp and stay secure!

Ask this episode

“What did the council decide on item 42?” — answered with the speaker and the moment.

Transcript

Related