The Iru Blog

Arek Dreyer

•

6 min read

What Apple Business Actually Means for Your IT Team (And Whether It Replaces Your MDM)

Apple dropped a significant announcement on March 24, 2026: Apple Business Essentials, Apple Business Manager, and Apple Business Connect are going away. In their place, a unified platform simply called Apple Business launches on April 14. If your IT team is running any Apple devices, or if you've been relying on Apple Business Essentials for lightweight MDM, this affects you. Here's a clear-eyed look at what's actually changing, what Apple Business includes, and what it still doesn't do.

Educational April 6, 2026

Satyam Patel

•

4 min read

Beyond the Login: What CISA's Latest Recommendations Mean

The Cybersecurity and Infrastructure Security Agency (CISA) recently issued an urgent advisory urging U.S. organizations to harden their endpoint management systems. The guidance came in response to the Stryker attack, claimed by Handala, an Iranian-linked hacktivist group, which wiped thousands of corporate devices without a single piece of malware. The attacker had valid credentials, a live admin session, and access to tools the organization already trusted. That was enough.

Educational April 1, 2026

Calvin So

•

11 min read

Atomic Stealer (AMOS) Returns: ClickFix, Trojanized Crypto Apps, and a New macOS Persistence Mechanism

Atomic Stealer, commonly tracked as AMOS, has earned its place as one of the most persistent threats the macOS threat landscape. Powered by a relentless development cycle and diverse distribution networks, it shows no signs of slowing down. Researchers have extensively documented its signature tactics: "ClickFix" browser social engineering prompts, trojanized application installers, and, most recently, the "malext" variants spread through malvertising campaigns.

Threat Intelligence March 31, 2026

Iru Team

•

6 min read

The Guide to Managing Mac Clusters for AI Workloads

Mac clusters for AI workloads are real infrastructure now. Here’s how to provision, secure, and manage them from day one.

Educational March 24, 2026

Iru Team

•

6 min read

The right Blueprint, every time: how Iru's Blueprint Routing automates device deployment at enrollment

Enrolling a fleet of devices sounds simple in theory: pick a Blueprint, assign some settings, and you're done. But in practice, most organizations are managing a mix of Mac computers, Windows computers, iPhone devices, iPad devices, kiosk tablets, and meeting room devices, each with their own configurations, user types, and provisioning requirements. Keeping all of that straight at enrollment time, without manual intervention or a tangle of enrollment codes, has historically been one of the more tedious parts of device management.

Educational March 16, 2026

Kunal Prakash

•

3 min read

Stop Threats Instantly with Device Isolation for Iru EDR

Respond to serious threats by isolating compromised devices from the network. Iru retains a secure, remote connection with the device.

Product News March 5, 2026

Calvin So

•

17 min read

macOS Malware Analysis: Music Plugin DMG Loader

On February 4, 2026, security researchers discovered a mass-distributed loader disguised as predominantly cracked music plugin DMGs used to deliver multiple multistage macOS malware, such as Odyssey and MacSyncStealer, in addition to a Mach-O binary containing another loader to an additional payload.

Threat Intelligence February 19, 2026

Mike Boylan

•

3 min read

Introducing Blueprint Routing

Today, we’re excited to announce the general availability of Blueprint Routing, a new enrollment capability in Iru that dynamically assigns devices to Blueprints during enrollment, based on device and user attributes collected at that moment.

Product News February 18, 2026

Shwena Kak

•

8 min read

The Security Implications of OpenClaw and Autonomous AI Agents

In recent months, a new class of AI tools has gained momentum, blurring the line between traditional assistants and fully autonomous automation platforms. OpenClaw, previously known as Clawdbot and Moltbot, is designed to execute tasks for users with little ongoing human involvement, including file management, workflow automation, and direct shell command execution. Its rapid viral growth and strong community adoption, with almost 200,000 GitHub stars, have brought attention to a new category of AI tools that operate with deeper system access than most conversational AI platforms.

Threat Intelligence February 13, 2026

Candace Jensen

•

3 min read

The hidden risks of the Homebrew Cellar in Vulnerability Management

In the modern macOS ecosystem, Homebrew is a staple: the engine under the hood in software engineers' day to day development, and a productivity enhancer for macOS power users. However, its convenience and ubiquity may introduce a significant blind spot for security teams if they lack visibility into the "Cellar" - the specific location where Homebrew stores its binaries, known as formulae. Its hidden dependencies, lingering outdated binaries, and relaxed permissions can create serious security gaps. When a workstation may be the gateway to cloud and production systems, those gaps matter.

Threat Intelligence February 12, 2026

Adam Henry

•

4 min read

The Better Way to Migrate iOS and iPadOS Devices

Moving to a new device management solution has never been easier. With iOS 26 and iPadOS 26, we're introducing support for a powerful migration feature that transform how organizations transition their iPhone and iPad fleet to Iru.

Educational February 2, 2026

Csaba Fitzl

•

7 min read

The Dangers of Cracking Tools

This blog article highlights one particular risk that arises from using various tools to crack software: introducing vulnerabilities to their environment. This article provides a general overview, examines past cases, and dives into an actual local privilege escalation vulnerability we uncovered in a macOS software cracker.

Threat Intelligence January 28, 2026

Lance Crandall

•

5 min read

5 Use Cases for Custom PowerShell Scripts in Windows Device Management

Modern Windows device management has come a long way. With UEM-based endpoint management, IT teams can enforce security baselines, configure system settings, deploy applications, and maintain compliance at scale. But even in the most mature Windows management environments, there are always scenarios that require customization. That’s where PowerShell scripting continues to play an important role.

Educational January 23, 2026

Calvin So

•

6 min read

Analyzing the MonetaStealer macOS Threat

On January 6, 2026, security researchers at Iru discovered a suspicious Mach-O binary masquerading as a Windows .exe file. Investigation revealed the file is a PyInstaller-compiled binary that executes malware hidden within a .pyc file. Researchers named the malware MonetaStealer. The malware contains limited capabilities and lacks anti-analysis/persistence mechanisms. Researchers believe it is still in its very early development phase and relies heavily on AI code. MonetaStealer maintains a zero-detection rate on VirusTotal as of the time of writing.

Threat Intelligence January 14, 2026

Calvin So

•

9 min read

Investigating Shai-Hulud: Inside the NPM Supply Chain Worm

On August 26, 2025, attackers exploited a GitHub Actions injection vulnerability inside Nx’s workflow, using a manipulated pull request title to run shell commands and extract the company’s NPM publishing token. With that access, they published malicious versions of trusted Nx packages. Once installed, those packages hijacked local AI command line tools to scan victim systems for credentials, SSH keys, and crypto wallets.

Threat Intelligence December 4, 2025