The Iru Blog

Introducing macOS LAPS in Iru: Secure, automated local admin passwords

Apple OS 27 is here. Iru is ready.

Remediating Windows vulnerabilities with a single tool

Vulnerability Response is now available for Windows. Find, prioritize, and patch in one place, the same way you do for Mac.

Rustbot, the macOS malware used in the latest Rust Supply Chain Attack

On August 20, 2026, attackers published malicious versions of three widely used Rust packages to crates.io, the official Rust package registry. On macOS, the payload is a remote access trojan (RAT) that collects cloud credentials, SSH keys, cryptocurrency wallet data, and browser profile information, then sends it to attacker-controlled infrastructure. It installs a launch agent to survive reboots and accepts follow-on commands from its operators. Once running, it decrypts its configuration, profiles the host, Reads the local browser stores, installs persistence via LaunchAgent, and beacons out. The packages were available for approximately two hours before removal. The attackers also withdrew the previous stable versions, which pushed automated dependency resolution toward the compromised releases. Any environment that compiled an affected project during that window should be treated as compromised. This blog documents Iru's analysis of the native Apple Silicon ARM64 implant.

Inside the screensharingd Bugs: How macOS Screen Sharing Went from Root File Access to Pre-Auth Compromise

In late July 2026, a cluster of vulnerabilities in macOS Screen Sharing turned what initially looked like a fairly constrained privilege problem into one of the more interesting macOS remote-attack stories in years.

Apple is deprecating hdiutil in macOS 27 Golden Gate. Are your scripts ready?

If you spent part of last weekend fielding Slack messages about hdiutil, you're not alone. Jeff Johnson's lapcatsoftware.com blog flagged that the man page for hdiutil in the macOS 27 Golden Gate beta now carries a deprecation notice:

Apple beta testing and device management services: the perfect match

Every fall, Apple’s newest operating systems arrive everywhere at once. That’s great for users, but it puts IT teams on the clock: they need to validate the release, find blockers, prepare their support teams, and decide when the business is ready to move.

Endpoint security for Mac: How to protect macOS at scale

Mac endpoint security combines built-in macOS protections with centralized tools that help you monitor devices, enforce policies, detect threats, and respond quickly across your entire fleet. Built-in macOS security features like Gatekeeper and XProtect provide a strong foundation, but they don't offer the visibility, automation, threat detection, or behavior detection needed to secure Mac devices at scale. Layering third-party tools such as endpoint management, endpoint detection and response (EDR), and vulnerability management closes those gaps. With Iru, you can manage and remediate your Mac fleet from a single AI-powered platform, giving your IT and security teams more time and control. Your Mac fleet grows one device at a time. Then, almost overnight, you're supporting remote employees, multiple offices, and hundreds of endpoints. At that point, endpoint security for Mac isn't just about protecting individual devices. It's about knowing what's happening across your entire environment.

What is endpoint monitoring? A practical IT and security guide

Modern IT environments rarely stay still. Employees work across offices, homes, and coworking spaces. New devices join the fleet. Software changes. Configurations drift. And then the compliance audit notice arrives.

How a single PostScript file leaks your Mac's memory

When I started my InfoSec journey, most of the offensive classes I took focused on memory corruption exploits. I learned a lot about buffer overflows, DEP and ASLR bypasses, and even got into kernel exploitation. However, since my job at that time was mostly hunting for bad guys in an insane amount of logs and telemetry data, I never really had the time to apply this knowledge.

Reliable Windows app patching with Iru system tray notifications

Notify Windows users when app updates are available. When your users are ready, they can allow Iru to close the app and update the application. Employees get more control over when updates land, and you spend less time chasing down unpatched devices.

Iru Quarterly Threat Report: August 2026

EDR threat detections and responses Iru EDR is built to detect threats before they go mainstream. By combining behavioral detections with insights from our own malware research, we're able to protect customers from exploitation even before public disclosures or patches become available.

Feature engineering for a macOS malware classifier, and why the Mac makes it harder than Windows

The threat landscape for macOS malware is expanding, while the number of specialists dedicated to defending against it has not kept pace. Unlike Windows, where machine learning (ML) models are supported by extensive documentation and standardized datasets, the macOS environment presents a significant knowledge gap. At Iru, we captured SSTAR Agent, a crypto drainer targeting web3 technology developers via a fake interview lure, which we documented in an earlier post using an ML triage we built.

What is a cybersecurity risk assessment? How to conduct one

Cybersecurity has become one of the defining business risks of the modern era. In a recent U.S. Chamber of Commerce survey, 60% of small businesses said cybersecurity threats are a top concern, ranking above theft, natural disasters, and terrorism.