Iru Quarterly Threat Report: August 2026

EDR threat detections and responses

Iru EDR is built to detect threats before they go mainstream. By combining behavioral detections with insights from our own malware research, we're able to protect customers from exploitation even before public disclosures or patches become available.

The trend we flagged last quarter didn't slow down: fake interview lures targeting developers kept evolving, and this quarter our researchers documented an entirely new cross platform implant being delivered through them. Here's what we found.

SStar Agent: a cross platform RAT hiding in a take home assessment

Detection: Iru researchers Adam Kohler and Calvin So documented SStar Agent, a Go based cross platform RAT with victimology targeting web3 developers. The discovery started as a side effect of an internal ML experiment.

We recovered four samples: three macOS binaries (arm64 and x86_64) and a Windows PE, all sharing a single campaign deployment hash. Delivery follows the fake interview playbook we covered last quarter. A professional looking Web3 take home assessment on GitHub, with the payload hidden not in the repository (which is genuinely clean) but in a poisoned npm dependency, tw-style-utils, masquerading as a Tailwind CSS typography plugin. The payload fires at build time, not install time, so npm install --ignore-scripts offers no protection.

What makes SStar Agent notable is the platform gap. The macOS builds stub out keylogging, clipboard monitoring, and screen capture. The function symbols exist, but the bodies are single instruction stubs. The Windows build implements all three, with keylogging and clipboard monitoring enabled by default. Every beacon, on every platform, exfiltrates the complete Chrome extension inventory of the infected host, a full filesystem tree of the home directory, and system metadata. The C2 domain, api.otter-stack.com, was registered April 22, 2026, fronts an operator web console at its root, and serves per platform payloads at /d/{hash}/agent?os=&arch=, with the same deployment hash baked into every agent binary. The macOS/Windows capability gap strongly suggests this is a work in progress, and the macOS feature set is coming.

Response: Iru EDR's behavioral detections flag these malicious binaries and additionally included IOCs, C2 endpoints, and MITRE ATT&CK mapping that are in the complete writeup on our blog. If your developers are taking home coding tests, this campaign is aimed squarely at them.

Teaching a machine to spot Mac malware: why the Mac makes it harder than Windows

Detection: The ML triage that surfaced SStar Agent didn't come for free. Iru researchers Calvin So, Cristian Molina, and Jacky Xue published a deep dive on what it takes to build a machine learning classifier for macOS malware, drawn from a corpus of 7,138 Mach-O samples (3,254 malicious, 3,884 benign) collected between June 2025 and June 2026. The short version: on Windows, ML feature engineering is largely a literature review; on macOS, it's original research. There's no Mach-O equivalent of the public datasets and established pipelines Windows defenders lean on, and nearly every "obvious" feature turned out to be measuring something other than malice. Entropy, a workhorse signal on Windows, failed outright: legitimate Mac software built with Go or Electron looks just as "random" as packed malware. String and symbol features kept scoring high by fingerprinting compiler toolchains rather than behavior. Even code signing status, the single strongest signal in the dataset (unsigned binaries were 93% malicious), records whether a binary passed through Apple's distribution pipeline, not what it does, and collapses the moment an attacker obtains a valid Developer ID. The standout capability signal was the com.apple.security.get-task-allow entitlement: of 403 binaries carrying it, 99% were malicious.

Response: No feature survived scrutiny unchanged, and that's the point. The features that made it into the first training run, signing status, entitlements, behavioral symbols like fork and execl, per-segment entropy, were kept with their biases documented, and the toolchain artifacts and memorized sample strings were thrown out. This classifier is what flagged SStar Agent in the first place, and every correction from this research makes the next early catch more likely. The full methodology is in the complete writeup on our blog.

Vulnerability management

Iru's vulnerability management work covers both macOS and Windows fleets, and runs on two tracks: original research that ships back upstream to Apple and the broader ecosystem, and detection content that protects customers across the operating systems they actually run. Q2 was the busiest quarter yet: Iru security researchers delivered 696 distinct CVE enrichments, accounting for 68.1% of all enrichments shipped so far in 2026. The majority came from ongoing coverage of high-traffic software like Chrome, Edge, and Office, keeping customers ahead of the patch cycle where it matters most. That work is increasingly critical: roughly 29% of Q2 CVEs were still sitting in NVD's "awaiting analysis" queue, meaning that without Iru's threat intelligence enrichment, customers would have had little actionable data for those vulnerabilities.

Vulnerability acknowledgements: Nine CVEs for Csaba Fitzl

Detection: Principal macOS Security Researcher Csaba Fitzl had another strong showing across this quarter's Apple security releases. Nine CVEs were credited to Csaba spanning macOS Tahoe 26.2 through 26.6, along with the corresponding macOS Sequoia, macOS Sonoma, iOS, iPadOS, watchOS, tvOS, and visionOS updates. Three are root privilege escalations reachable from a malicious application: a path traversal flaw in path handling (CVE-2026-20615), a race condition caused by improper state handling during concurrent execution (CVE-2026-20617), and an improper authorization issue in fskitd (CVE-2026-28951). Two are sandbox escapes: a parsing issue in the handling of directory paths (CVE-2026-28827) and an improper access control flaw in the macOS sandbox architecture (CVE-2025-43524). Two privacy issues round out the earlier releases: an app could capture a user's screen through improperly handled temporary files (CVE-2026-20622), and an app could access sensitive user data, which Apple fixed by relocating that data (CVE-2026-28881).

macOS Tahoe 26.6 acknowledged 2 more vulnerabilities. A CoreMedia authorization flaw let an app access sensitive user data; Apple fixed it with improved state management (CVE-2026-43775). A Spotlight out-of-bounds read exposed sensitive user data; Apple fixed it with improved bounds checking (CVE-2026-43774).

Response: Offensive research is how we sharpen the defensive side of the house. Finding these bugs before attackers do means the fix ships in an Apple update instead of a breach report, and every root escalation, sandbox escape, and privacy bypass Csaba uncovers feeds directly back into how we build detections. We don't just watch for known malware; we understand the primitives attackers will build with next, because we found them first.

On the road: Iru researchers on stage

• MacDevOpsYvr26 (June 25–26): Calvin So presented "What's going on with my Mac Malware?", covering the current state of the macOS threat landscape.
• BSides Las Vegas (August 3–5): Adam Kohler presented "The State of Mac Malware: How macOS Became a First-Class Target".