The Iru Blog

Rustbot, the macOS malware used in the latest Rust Supply Chain Attack

Inside the screensharingd Bugs: How macOS Screen Sharing Went from Root File Access to Pre-Auth Compromise

Apple is deprecating hdiutil in macOS 27 Golden Gate. Are your scripts ready?

If you spent part of last weekend fielding Slack messages about hdiutil, you're not alone. Jeff Johnson's lapcatsoftware.com blog flagged that the man page for hdiutil in the macOS 27 Golden Gate beta now carries a deprecation notice:

Apple beta testing and device management services: the perfect match

Every fall, Apple’s newest operating systems arrive everywhere at once. That’s great for users, but it puts IT teams on the clock: they need to validate the release, find blockers, prepare their support teams, and decide when the business is ready to move.

Endpoint security for Mac: How to protect macOS at scale

Mac endpoint security combines built-in macOS protections with centralized tools that help you monitor devices, enforce policies, detect threats, and respond quickly across your entire fleet. Built-in macOS security features like Gatekeeper and XProtect provide a strong foundation, but they don't offer the visibility, automation, threat detection, or behavior detection needed to secure Mac devices at scale. Layering third-party tools such as endpoint management, endpoint detection and response (EDR), and vulnerability management closes those gaps. With Iru, you can manage and remediate your Mac fleet from a single AI-powered platform, giving your IT and security teams more time and control. Your Mac fleet grows one device at a time. Then, almost overnight, you're supporting remote employees, multiple offices, and hundreds of endpoints. At that point, endpoint security for Mac isn't just about protecting individual devices. It's about knowing what's happening across your entire environment.

What is endpoint monitoring? A practical IT and security guide

Modern IT environments rarely stay still. Employees work across offices, homes, and coworking spaces. New devices join the fleet. Software changes. Configurations drift. And then the compliance audit notice arrives.

How a single PostScript file leaks your Mac's memory

When I started my InfoSec journey, most of the offensive classes I took focused on memory corruption exploits. I learned a lot about buffer overflows, DEP and ASLR bypasses, and even got into kernel exploitation. However, since my job at that time was mostly hunting for bad guys in an insane amount of logs and telemetry data, I never really had the time to apply this knowledge.

Reliable Windows app patching with Iru system tray notifications

Notify Windows users when app updates are available. When your users are ready, they can allow Iru to close the app and update the application. Employees get more control over when updates land, and you spend less time chasing down unpatched devices.

Iru Quarterly Threat Report: August 2026

EDR threat detections and responses Iru EDR is built to detect threats before they go mainstream. By combining behavioral detections with insights from our own malware research, we're able to protect customers from exploitation even before public disclosures or patches become available.

Feature engineering for a macOS malware classifier, and why the Mac makes it harder than Windows

The threat landscape for macOS malware is expanding, while the number of specialists dedicated to defending against it has not kept pace. Unlike Windows, where machine learning (ML) models are supported by extensive documentation and standardized datasets, the macOS environment presents a significant knowledge gap. At Iru, we captured SSTAR Agent, a crypto drainer targeting web3 technology developers via a fake interview lure, which we documented in an earlier post using an ML triage we built.

What is a cybersecurity risk assessment? How to conduct one

Cybersecurity has become one of the defining business risks of the modern era. In a recent U.S. Chamber of Commerce survey, 60% of small businesses said cybersecurity threats are a top concern, ranking above theft, natural disasters, and terrorism.

What is vulnerability remediation? 4 ways to handle it

What is vulnerability remediation? Vulnerability remediation is the process of eliminating security vulnerabilities before attackers can exploit them. It involves identifying affected systems, prioritizing the most critical risks, and taking corrective action.

What is endpoint vulnerability management (EVM)? (+Best practices)

Endpoint vulnerability management (EVM) is the process of identifying, evaluating, prioritizing, and remediating security weaknesses on your endpoints before attackers can exploit them. Modern endpoint fleets are constantly changing. New devices come online, software updates roll out at different times, and vulnerabilities appear every day. For context, 2025 saw 49,183 new Common Vulnerabilities and Exposures (CVEs).

How-to guide: Changing and resetting Mac passwords

This post was originally published in May 2023 and has been updated in July 2026 to reflect the latest information. When was the last time you or someone in your organization needed their Mac password to be something different than what it previously was? There are two ways to do that: change or reset. But although those two words might seem similar, their difference is significant.