Behind the Binary by Google Cloud Security

In this episode of Behind the Binary, we sit down with Mac security researcher Christopher Lopez (L0psec). to discuss the evolving landscape of macOS malware. As Mac adoption continues to grow in enterprise environments and among developers, threat actors are increasingly targeting the platform. 
Chris breaks down current attack vectors, starting with the rise of social engineering tactics like ClickFix, fake software downloads, and malvertising campaigns. They explore how infostealer families like Atomic Stealer (AMOS) and persistent backdoor threats have matured, transitioning from simple cleartext scripts to complex, multi-layered obfuscation, C2 fail-safes, and anti-analysis checks. The conversation also covers DPRK APT campaigns targeting developers through fake job interviews and compromised VS Code environments. 
Finally, Josh and Chris discuss the impact of AI and LLM-driven workflows on the reverse engineering discipline. They dive into the balance between automated code deobfuscation, rapid detection engineering, and the loss of traditional manual reversing workflows as the industry shifts toward reversing at scale. 
Key Topics Covered:
Enterprise macOS adoption and the expanding threat surface 
Initial access vectors: ClickFix, malvertising, and Terminal social engineering 
Evolution of Mac InfoStealers (AMOS/Atomic Stealer, MacSync) and persistence 
Advanced threats: DPRK developer targeting via VS Code tasks 
Obfuscation trends: Dynamic AES encryption, C2 key retrieval, and external fail-safe C2s 
AI's dual role in malware development and reverse engineering workflows 
System protections: TCC, SIP, Endpoint Security (ES) APIs, and macOS security prompts 
Join the Community
Research Hub: Threat research, training events and news:
https://cloud.google.com/security/flare
The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com
FOLLOW THE SHOW:
Subscribe: Apple Podcasts | Spotify | YouTube

"Throwing more LLM prompts at a packed binary won’t make your analysis faster. But combining code similarity with AI will."
In Episode 29 of Behind the Binary, Jonas Wagner and Endre Bangerter of ThreatRay join the podcast to lay out the real-world state of binary similarity in the LLM era. They demystify the current AI hype cycle, explaining why large language models are structurally unsuited for raw, unguided binary analysis, and how traditional binary similarity techniques are finding a massive resurgence as the ultimate intelligence pre-filter.
Learn how they automate the classification of complex compiled samples by separating known-good libraries from unique malware code, and how these combined workflows are shrinking threat attribution timelines down from days to minutes.
THE SESSION:
Beyond BinDiff: Tracing the transition from expert-crafted syntactic tools to deep semantic vector matching.
The Token-Saver Pipeline: How to stop wasting LLM context windows on standard library runtimes (like Go and Rust) and target only custom, unique malware functions.
Dynamic Unpacking: Leveraging sandbox execution and memory dumps to capture clean binary representations before static analysis begins.
Anti-AI Obfuscation: The emerging landscape of adversarial techniques designed to throw off both similarity algorithms and LLMs.
Scale and Attribution: Building indexed code repositories to search back in time and attribute code reuse across decades of malware families.
Join the Community
Research Hub: Threat research, training events and news:
https://cloud.google.com/security/flare
The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com
FOLLOW THE SHOW:
Subscribe: Apple Podcasts | Spotify | YouTube

In this episode, we're joined by security researcher Olivia Gallucci to explore macOS low-level security, kernel exploitation, and macOS threat trends. We break down how macOS internals differ from Linux—focusing on IOKit, C++ dynamic class resolution, and Vtable hijacking in kernel drivers. Olivia explains the mechanics behind use-after-free (UAF) vulnerabilities, heap shaping, and legacy kernel exploits, as well as modern Apple hardware and OS defenses like Pointer Authentication Codes (PAC) and kalloc type isolation (PAC IA/DA semantics). 
We also discuss the evolution of macOS threat research, the rise of macOS info stealers driven by cryptocurrency targeting, local detection telemetry using Endpoint Security (ES) and tools like Mac Monitor, and the current dynamics of vulnerability research and bug bounty programs. 
Key Discussion Points:
Mac vs. Linux Internals: Why macOS isn't "just Linux," and how IOKit’s C++ driver framework creates unique attack surface. 
Vtable Hijacking & Kernel Exploits: How dynamic method resolution and C++ polymorphism are targeted using UAF, out-of-bounds writes, and heap shaping. 
Modern Defenses: How Apple leverages Pointer Authentication Codes (PAC IA/DA) and type-isolated heap allocators to disrupt traditional exploit primitives. 
The Rise of macOS Infostealers: What drove the surge in macOS stealer malware, their simple architecture, and social engineering delivery tactics. 
Detection & Telemetry: Monitoring local exploit failures, kernel panics, and process events via Endpoint Security (ES Logger) and open-source tools like Mac Monitor. 
Vulnerability Research Ecosystem: The role of AI in technical research, shifting bug bounty payouts, and the dynamics between vendor programs and third-party research. 
Resources mentioned:
Olivia Gallucci's Blog: oliviagallucci.com
Mac Monitor by Brandon Dalton: https://github.com/Brandon7CC/mac-monitor
Join the Community
Research Hub: Threat research, training events and news:
https://cloud.google.com/security/flare
The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com
FOLLOW THE SHOW:
Subscribe: Apple Podcasts | Spotify | YouTube

When malware analysis first emerged, reverse engineers typically operated in a straightforward C landscape — standard Win32 APIs, no massive runtimes, and clear code paths. Today, the landscape has fundamentally shifted. The natural progression to C++ introduced object-oriented hurdles like virtual function tables and standard template library bloat, laying the groundwork for the complexities we see in today's modern ecosystem. In this episode of Behind the Binary, we sit down with Jae Young Kim from the FLARE team to discuss navigating this evolution and what it actually takes to reverse engineer modern compiled languages like Go and Rust.
Jae walks us through his journey of diving head-first into the Go compiler architecture and source code to build a comprehensive internals reference for the FLARE Learning Hub. We discuss why understanding language quirks from the inside out is essential for professional analysts, look at the reality of recovering symbols from "stripped" Go binaries, and explore why traditional workflows like Time Travel Debugging (TTD) often get buried under runtime cruft. Finally, we look at the immediate future of the trade: how LLMs are already excelling at high-level decompilation and what languages he thinks are going to play a more significant role (hint - .NET AOT and Nim came up).
THE SESSION:
The Modern Language Shift: How the transition from C and C++ to sprawling, modern compiled runtimes has altered the day-to-day workflow of threat researchers and steepened the learning curve for beginners.
Demystifying Go Internals: Jae’s perspective on why Go's compact design philosophy can actually make it a highly systematic, and occasionally pleasant, reversing experience once you master its unique quirks and calling conventions.
The Myth of the "Stripped" Go Binary: A look at how tools like goReSym leverage intact compilation metadata to programmatically restore original function names and type definitions.
AI and the Future Decompiler: An honest assessment of how current LLMs handle assembly-to-source reconstruction, where hallucination verification still requires a human in the loop, and how automated tooling will reshape the analysis pipeline.
Emerging Blind Spots: A primer on the next operational hurdles for threat researchers, including the rising frequency of native ahead-of-time (.NET AOT) compilations and wildcard languages like Nim.
References:
FLARE Learning Hub
Join the Community
Research Hub: Threat research, training events and news:
https://cloud.google.com/security/flare
The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com
FOLLOW THE SHOW:
Subscribe: Apple Podcasts | Spotify | YouTube

Mobile security boundaries rely on isolating remote, untrusted inputs from highly privileged system components. However, when new automated features are introduced, the available attack surface can shift—sometimes exposing unexpected code paths to remote attackers.
In the latest episode of Behind the Binary, we sit down with Seth Jenkins from Google Project Zero to dissect a full two-bug, zero-click exploitation chain targeting the Pixel 9. By chaining a user-space decoder flaw with a kernel driver race condition and a kernel ASLR bypass, researchers achieved remote code execution and a device-wide SELinux sandbox escape.
Key takeaways from our technical breakdown:
The AI Attack Surface Shift: How implementing automatic voice message transcription inadvertently exposed the Dolby audio decoder (EAC3) to remote inputs.
Defeating Userland ASLR: The mechanics of an integer overflow in user space (CVE-2025-54957) and how a partial pointer overwrite bypassed ASLR.
Rigging the Race Condition: A look inside the "Big Wave" kernel driver use-after-free (CVE-2025-36934), a single bug that allows an attacker to jump from the mediacodec sandbox to the kernel. .
The Predictable KASLR Reality: How standard ARM64 linear mapping combined with static bootloader placements negated kernel randomization—allowing two arbitrary writes to escalate privileges to root with SELinux disabled.
Join the Community
Research Hub: Threat research, training events and news:
https://cloud.google.com/security/flare
The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com
FOLLOW THE SHOW:
Subscribe: Apple Podcasts | Spotify | YouTube