All Huntress Blog Posts

We reverse-engineered MacSync, a six-stage macOS stealer and RAT, recovered from attacker infrastructure after the victim’s host was taken offline.

A compromised terminal server became a phishing stager. A fake Boots survey aimed at 8.9 million inboxes, with the payload on a hacked Bolivian government site.

Huntress caught a threat actor deploying the open-source Komari monitoring agent as a persistent SYSTEM-level backdoor. See how they abused a legitimate GitHub project, and learn what defenders should hunt for.