BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.balccon.org//balccon2k26-2026//talk//ZXZZQN
BEGIN:VTIMEZONE
TZID:CET
BEGIN:STANDARD
DTSTART:20001029T040000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000326T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=3
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-balccon2k26-2026-ZXZZQN@cfp.balccon.org
DTSTART;TZID=CET:20260918T150000
DTEND;TZID=CET:20260918T154000
DESCRIPTION:For years\, a persistent myth suggested that macOS was inherent
 ly immune to malware. Today\, threat actors are aggressively shattering th
 at illusion by deploying sophisticated initial access chains tailored to b
 ypass macOS defenses. This talk provides a deep-dive analysis of how moder
 n adversaries gain their first foothold on Apple hardware.\n\nWe will diss
 ect the entire initial access pipeline\, starting with Infection Vectors l
 ike deceptive Google Ads\, malicious ClickFix campaigns\, and sophisticate
 d malvertising that trick users into lowering their guard. From there\, we
  explore the Execution Phase\, analyzing how attackers weaponize scripting
  languages\, including traditional Bash and Python\, as well as native App
 leScript\, Compiled AppleScript\, Perl\, and JavaScript for Automation (JX
 A). \n\nFinally\, we will examine the delivery mechanisms\, contrasting th
 e abuse of native Binaries (Mach-O\, Platypus-packaged apps\, and Electron
  frameworks) with the trojanization of Storage and Installer Formats (DMGs
  and PKGs).\n\nAttendees will walk away with a technical understanding of 
 contemporary macOS tradecraft\, real-world attacker methodologies\, and th
 e insights needed to hunt for and defend against modern Mac-focused threat
 s.
DTSTAMP:20260901T071608Z
LOCATION:Pupin
SUMMARY:Deconstructing Modern macOS Initial Access Vectors - Stephan Berger
URL:https://cfp.balccon.org/balccon2k26-2026/talk/ZXZZQN/
END:VEVENT
END:VCALENDAR