https://mac.sploit.dk/tags/macos/ Recent content in Macos on Martin's Blog Hugo en-us Tue, 09 Jun 2026 00:00:00 +0000 https://mac.sploit.dk/blog/detecting-the-kelpdao-bridge-intrusion/ Tue, 09 Jun 2026 00:00:00 +0000 https://mac.sploit.dk/blog/detecting-the-kelpdao-bridge-intrusion/ A friend’s EDR and managed service stayed silent through a $292M bridge theft. So I took the public incident report, pulled the three recovered macOS samples, and analysed them statically: a Go-based trojanized Terraform provider, a Rust Telegram stealer, and a Rust Nostr RAT, to see whether I could turn the tradecraft into durable behavioral detections. Decompiling the loader, carving the embedded Python stealer, tracing the async Nostr dispatcher by xref, and mapping every confirmed TTP to a CrowdStrike Custom IOA. All without running the malware.