Is this binary Naughty or Nice? How Google leverages ML and Santa to detect persistence on MacOS

Main Stage·41 min

• DEF CON
• Red Team
• Date: Aug 2025
• Location: Las Vegas

Shang-De Jiang · Dong-Yi Ye · Tung-lin Lee

Demonstrates techniques for stealing Microsoft Primary Refresh Tokens (PRT) and cookies on macOS endpoints to achieve persistent access to Entra ID cloud resources.

Main Stage·47 min

• DEF CON
• Malware
• Date: Aug 2023
• Location: Las Vegas

Patrick Wardle

Patrick Wardle dissects macOS Ventura's Background Task Management architecture, releasing open-source tooling while demonstrating trivial evasion techniques.

BSides Portland (PDX)·29 min

• BSides
• Blue Team
• Date: 2022
• Location: Bsides

Provides macOS persistence, LaunchAgents and Beyond and evaluates key implications for security practitioners.