Threat Hunting macOS Book

I first met Jaron Bradley years ago at my favorite pizza restaurant in Paia, Maui. At the time, he was living on the Big Island while I was on Maui, and we were already deeply — albeit separately — immersed in the world of macOS security. Over slices of pizza and infosec banter, Jaron handed me a copy of his first book, a gesture I’ve never forgotten. I still have that copy today, now well-read and dog-eared. That meetup marked the beginning of a friendship rooted in a shared fascination with Apple’s desktop operating system and the malware, along with the wily hackers, increasingly targeting it.

Since then, we’ve reversed malware samples, uncovered zero-days, analyzed Apple’s evolving security mechanisms, and explored the many ways attackers continue to bypass them.

Jaron has become a leading voice in macOS security. He regularly speaks at top security conferences and holds the notable distinction of presenting at every Objective by the Sea. His talks are consistently insightful, backed by impressively designed slides that reflect both technical depth and clarity. In parallel, he offers a macOS threat hunting training that routinely sells out. He doesn’t just teach, he equips others to think critically, ask the right questions, and dig deeper.

In addition to his research and writing, Jaron has created several tools that reflect his expertise and practical mindset. Among them is TrueTree, an indispensable utility for macOS threat hunting and incident response. These contributions have meaningfully advanced the field and continue to support analysts in real-world investigations.

This book, like his first, is sure to become indispensable. As Macs continue to gain popularity, especially within enterprise environments, macOS malware is growing in parallel, becoming not only more prevalent but also significantly more sophisticated. In this context, the book is essential reading. It offers clear, deeply technical, and highly relevant guidance on a broad range of topics, from persistence and credential theft to inter-process communication and Apple’s Endpoint Security. Whether you are defending Apple fleets, analyzing malware, or simply seeking to understand macOS at a deeper level, this book will serve you well.

I consider myself lucky to call Jaron not only a respected colleague, but an even closer friend. His work continues to inspire and to raise the bar for macOS security research and education. And yes, I may just try to drag him back to that same pizza restaurant — not for the pizza, but for an in-person delivery of this book too!

Patrick Wardle

Founder, Objective-See Foundation

Author, The Art of Mac Malware series