Jamf’s practitioner perspective recommends continuous employee training, threat hunting, AI governance, vulnerability testing and monitoring to address phishing, AI-agent risks and other ongoing threats.
An overview of commercial spyware describes how tools infect mobile devices, steal data, and evade detection, with examples including Crocodilus and Landfall. It also outlines warning signs and steps organizations can take to reduce risk.
Jamf Threat Labs analyzes CloudSyncD, a two-stage macOS backdoor delivered in a fake Zoom installer. It validates a phished password locally, hides it in a configuration file, and launches an embedded implant that beacons to operator infrastructure.
Jamf has launched BYOK for Jamf Pro customers hosted in its Frankfurt cloud region. Customers manage the application-level encryption key through supported key management systems and can revoke Jamf’s access.
The article outlines controls for limiting AI agents’ enterprise authority, including distinct identities, scoped credentials, constrained tools, deterministic authorization, trusted human approval and staged outputs.
At JNUC 2026, Jamf announced expanded AI governance for Mac, mobile and browsers, plus device-health monitoring, staged rollouts, APIs and on-device AI management. Its tools aim to help organizations monitor and control AI use on endpoints.
At JNUC 2026, Jamf announced platform updates including on-device compliance checks and remediation, per-app risk scoring, device reporting and audit history, consolidated APIs, and tools for managing shared and BYOD devices.
Jamf Threat Labs analyzed a PamStealer variant delivered through a fake Wavel wallet installer. Its Swift infostealer steals credentials and user data, while a live server key exchange protects the payload from static decryption.
The article outlines layered controls for enterprise AI agents, including capability inventories, isolated execution, network restrictions, and ongoing governance. It stresses that sandboxing alone cannot constrain actions taken with authorized credentials and APIs.
Serval’s approach separates an AI help-desk agent from a second agent that builds explicit, versioned workflows. People review and test workflows before use; runs are deterministic and auditable, without giving the LLM Jamf credentials.
Apple OS 27 adds macOS binary allow/deny controls, device-bound app configuration, declarative identity and credential management, streamlined privacy prompts, and expanded fleet monitoring and diagnostics for enterprise admins.
Apple’s OS 27 release adds education-focused identity, device-management, visibility and family-safety features, which the article says can help schools simplify administration and support secure learning environments.
Jamf has launched a gateway and platform APIs with unified OAuth 2.0 authentication, capability-based permissions and cross-platform audit records. The APIs support device management, compliance, blueprints and organization administration.
Examples involving Copilot, Slack AI, GitHub workflows and coding agents show how trusted AI systems can expose data or alter production systems. The article argues for least privilege, independent monitoring and deterministic authorization.
Jamf analyzed 14 unsigned macOS installers linked to Contagious Interview. The installers fetch staged scripts and OtterCookie, which can enable remote access, steal credentials, scan files, and capture clipboard contents.
AI agents can now solve many CTF challenges and find and patch vulnerabilities, but results vary widely. Performance drops on fresh challenges and real-world flaws, while AI raises questions about security testing and the future of human competition.
A back-to-school security checklist for school IT admins recommends auditing device enrollment, OS versions and check-ins, updating security baselines, reviewing filters and shadow IT, and preparing incident-response steps.
Apple says its alerts identify people specifically targeted by mercenary spyware, not confirmed compromises. The article advises verifying alerts independently, preserving device evidence, seeking expert forensics, enabling Lockdown Mode, updating iOS and securing Apple
The article examines security risks involving AI coding tools, exposed logs and storage, and autonomous agents, then recommends enterprise controls spanning data, identity, endpoints, applications and processes.
Jamf Threat Labs analyzed AmnesiaStealer, a three-stage macOS infostealer spread through ClickFix. It collects credentials and data, while a second module enables hidden, operator-controlled browser sessions; several attempted macOS bypasses failed in testing.
Jamf Threat Labs analyzed a fake Zoom installer that uses a .NET downloader to deliver Overlord RAT on macOS. The researchers describe its execution, C2 configuration and capabilities; they do not attribute the campaign to a specific actor.
An explainer outlines enterprise AI security risks, including shadow AI, stale indexed data and indirect prompt injection, and recommends operational controls for access, data handling and oversight.
Analysis of Coruna and Predator shows how spyware checks device and browser signals to avoid unsuitable targets and research environments. Tests found that Coruna’s IndexedDB probe can indicate private browsing and its checks can detect Lockdown Mode.
The article explains how a Qualcomm KGSL vulnerability, CVE-2025-21479, can let GPU DMA bypass Samsung kernel protections, corrupt a process page table, disable SELinux and inject code into Android's init process.