Uncover the lurking threat of ReaderUpdate. Learn about its persistence and the cyber risks it poses to macOS users.

Raffi just released an update to Crystal Palace (CP), so I wanted to write about some of the problems that I think it helps solve for PIC development and where it may take us in the future.

The philosophy of CP is to build evasion tradecraft as PIC that…

Crystal Palace is a PIC framework that can be used to write, among other things, prepended DLL loaders. The philosophy of the project is to apply evasion tradecraft (also written as PIC), to a capability at link-time. For a DLL, it does this by hooking the…

Microsoft warns: Infostealers now target macOS & use WhatsApp worms. "Eternidade" & "Crystal PDF" steal credentials via cross-platform attacks.

tl;dr

Inspired by Red Canary's Atomic Red Team, 'Atomic BOFs' is my attempt at an implementation pattern to ease detection engineering for Beacon Object Files.

GitHub - rasta-mouse/atomic-bofs: Atomic test units for BOF executionAtomic test units for BOF…

💡This blog was originally posted on 26 May 2026 and subsequently updated on 04 June 2026.

Module stomping (aka module overloading or DLL hollowing) is a technique for hiding malicious code within a process's memory. It essentially works by loading a legitimate…

In a previous post, I wrote about BOF Cocktails - an execution pattern to merge tradecraft into postex BOFs so they didn't have to rely on an agent/loader for their evasion. That post outlines the problem areas more fully, so I encourage you to read that…

Despite what some would lead you to believe, Crystal Kit is not, and was never intended to be, an all-encompassing nirvana of evasion tradecraft. It was a simple project to experiment with Crystal Palace (CPL) by applying evasion tradecraft to Cobalt Strike's…

Capabilities written to PICO conventions can be output as PIC, PICOs, or COFFs. These formats typically require some sort of 'runner' to inject them into memory - whether that's a shellcode runner, PICO runner, or COFF/BOF runner. There are several challenges…