# When macOS gets frostbite.

Page: https://stenobird.com/podcast/research-saturday-1377435/when-macos-gets-frostbite
Text version: https://stenobird.com/podcast/research-saturday-1377435/when-macos-gets-frostbite.md
Podcast: [Research Saturday](https://stenobird.com/podcast/research-saturday-1377435)
Published: 2025-12-06T06:00:00+00:00
Episode link: https://thecyberwire.com/podcasts/research-saturday/404/notes
Audio file: https://pdst.fm/e/pdrl.fm/6ec23a/traffic.megaphone.fm/CYBW9324297938.mp3?updated=1764952171
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/research-saturday-1377435/episodes/when-macos-gets-frostbite
Duration seconds: 1480

## Resource

Jaron Bradley, Director of Jamf Threat Labs, is sharing their work on "ChillyHell: A Deep Dive into a Modular macOS Backdoor." Jamf Threat Labs uncovers a newly notarized macOS backdoor called ChillyHell, tied to past UNC4487 activity and disguised as a legitimate applet. The malware showcases robust host profiling, multiple persistence mechanisms, timestomping, and flexible C2 communications over both DNS and HTTP. Its modular design includes reverse shells, payload delivery, self-updates, and a brute-force component targeting user credentials. The research can be found here: ⁠ChillyHell: A Deep Dive into a Modular macOS Backdoor Learn more about your ad choices. Visit megaphone.fm/adchoices

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/research-saturday-1377435/episodes/when-macos-gets-frostbite/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/research-saturday-1377435/when-macos-gets-frostbite.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.