SentinelOne

A new macOS stealer called Reaper — a SHub variant tracked by @sentinellabs.bsky.social — runs an infection chain where each stage hides behind a different trusted brand.

The lesson for defenders isn't "watch for Reaper." It's that brand recognition is not a signal of safety — it signals the attack. Unexpected AppleScript activity, outbound traffic after Script Editor runs, LaunchAgents in trusted-vendor namespaces — that's where to look.

A new macOS stealer called Reaper — a SHub variant tracked by @sentinellabs.bsky.social — runs an infection chain where each stage hides behind a different trusted brand.

- The lure: a fake WeChat or Miro installer - The delivery: a typo-squatted domain, mlcrosoft[.]co[.]com - The execution: dressed up as an Apple XProtectRemediator security update - The persistence: a fake Google Software Update directory, beaconing every 60 seconds

This is what a realistic AI-era attack chain looks like. Drawn from 11,000+ anonymized cloud environments in our 2026 report. No zero-day. No prompt injection research paper. No novel technique. What we see instead is a misconfigured bucket, one hardcoded key, and a model connected to a CRM.

Frontier AI isn't being built in isolation. Neither is the frontier of cyber defense. That’s why we’re proud to be a partner in OpenAI’s Trusted Access for Cyber (TAC) Program. Read more: s1.ai/GPT5-5Cyb

Threat actors are in a turf war for ownership of your infrastructure. @sentinellabs.bsky.social has uncovered PCPJack, a predatory cloud credential worm that hunts its own kind. Its first move? A scorched-earth eviction of rival group TeamPCP.

💀 Deploys Sliver C2 beacons via a second toolset, compiled with garble obfuscation to defeat signature detection 🚫 Zero cryptomining. None. In a world where every cloud worm drops XMRig eventually, this one doesn't. It's going straight for credential monetization, extortion, and fraud.

Threat actors are in a turf war for ownership of your infrastructure. @sentinellabs.bsky.social has uncovered PCPJack, a predatory cloud credential worm that hunts its own kind. Its first move? A scorched-earth eviction of rival group TeamPCP.

What PCPJack does after it wins the turf war:

Threat actors are in a turf war for ownership of your infrastructure. @sentinellabs.bsky.social has uncovered PCPJack, a predatory cloud credential worm that hunts its own kind. Its first move? A scorched-earth eviction of rival group TeamPCP.

In this @wired.com video about fast16, @agreenberg.bsky.social walks through the whole arc: A 2005 malware that sat in plain sight, the NSA leak that named it, and what @sentinellabs.bsky.social's Vitaly Kamluk and @jags.bsky.social finally figured out it was doing.

Frontier model. Frontier operators. Real threats, stopped before they become attacks.

Continuous discovery using the most advanced frontier models. Real exploitability, not paper risk. Mitigations that break attack chains before adversaries finish them.

Frontier model. Frontier operators. Real threats, stopped before they become attacks.

LABScon 2026 Call for Papers is open. Sept 16–19, Scottsdale. Invite-only. Fifth year.

The history of cyberwar just got rewritten with a new @sentinellabs.bsky.social discovery by Vitaly Kamluk and @jags.bsky.social. Stuxnet wasn't the beginning of nation-state sabotage through software. It was just the first one we caught. Read the full @wired.com story by @agreenberg.bsky.social 👇

Meet fast16 — compiled in 2005, five years before Stuxnet. It isn't espionage. It's not ransomware. It's a precision instrument designed to make scientists trust math that's been quietly broken. Silently. Precisely. Across an entire network.

The biggest risk in your AI strategy? What quietly disappears when AI handles the work that builds expertise. Here are three questions to pressure-test your exposure👇

By automating the "grunt work" of junior analysts, organizations aren't increasing efficiency. They are removing the very gym that builds the mental muscles for high-level judgment. 🧠💪

The biggest risk in your AI strategy? What quietly disappears when AI handles the work that builds expertise. Here are three questions to pressure-test your exposure👇

3️⃣ Which "wasteful" manual skills are you currently eliminating that are actually the essential training data for your future leaders?

The biggest risk in your AI strategy? What quietly disappears when AI handles the work that builds expertise. Here are three questions to pressure-test your exposure👇

1️⃣ If your senior staff retired tomorrow, could your juniors replicate their "smell test" decisions using only the AI tools provided?

The biggest risk in your AI strategy? What quietly disappears when AI handles the work that builds expertise. Here are three questions to pressure-test your exposure👇

Adversaries are now industrializing the breach. SentinelOne’s new Annual Threat Report is officially out, and this is one of the key takeaways. Targeting core systems like identity, infrastructure, and automation is not new—but executing these tactics at an industrial scale is.

Living Off the Pipeline: Compromise software pipelines enable code injection and secret theft. The Machine Multiplier: Automation—not just AI—is compressing response windows to seconds, not days.

Adversaries are now industrializing the breach. SentinelOne’s new Annual Threat Report is officially out, and this is one of the key takeaways. Targeting core systems like identity, infrastructure, and automation is not new—but executing these tactics at an industrial scale is.

This defender’s guide isn't a collection of stats or "actor branding"—it’s a deep dive into the mechanics of how adversaries exploit organizational blind spots.

Adversaries are now industrializing the breach. SentinelOne’s new Annual Threat Report is officially out, and this is one of the key takeaways. Targeting core systems like identity, infrastructure, and automation is not new—but executing these tactics at an industrial scale is.