The Iru Blog

macOS Malware Analysis: Music Plugin DMG Loader

Introducing Blueprint Routing

The Security Implications of OpenClaw and Autonomous AI Agents

In recent months, a new class of AI tools has gained momentum, blurring the line between traditional assistants and fully autonomous automation platforms. OpenClaw, previously known as Clawdbot and Moltbot, is designed to execute tasks for users with little ongoing human involvement, including file management, workflow automation, and direct shell command execution. Its rapid viral growth and strong community adoption, with almost 200,000 GitHub stars, have brought attention to a new category of AI tools that operate with deeper system access than most conversational AI platforms.

The hidden risks of the Homebrew Cellar in Vulnerability Management

In the modern macOS ecosystem, Homebrew is a staple: the engine under the hood in software engineers' day to day development, and a productivity enhancer for macOS power users. However, its convenience and ubiquity may introduce a significant blind spot for security teams if they lack visibility into the "Cellar" - the specific location where Homebrew stores its binaries, known as formulae. Its hidden dependencies, lingering outdated binaries, and relaxed permissions can create serious security gaps. When a workstation may be the gateway to cloud and production systems, those gaps matter.

The Better Way to Migrate iOS and iPadOS Devices

Moving to a new device management solution has never been easier. With iOS 26 and iPadOS 26, we're introducing support for a powerful migration feature that transform how organizations transition their iPhone and iPad fleet to Iru.

The Dangers of Cracking Tools

This blog article highlights one particular risk that arises from using various tools to crack software: introducing vulnerabilities to their environment. This article provides a general overview, examines past cases, and dives into an actual local privilege escalation vulnerability we uncovered in a macOS software cracker.

5 Use Cases for Custom PowerShell Scripts in Windows Device Management

Modern Windows device management has come a long way. With UEM-based endpoint management, IT teams can enforce security baselines, configure system settings, deploy applications, and maintain compliance at scale. But even in the most mature Windows management environments, there are always scenarios that require customization. That’s where PowerShell scripting continues to play an important role.

Analyzing the MonetaStealer macOS Threat

On January 6, 2026, security researchers at Iru discovered a suspicious Mach-O binary masquerading as a Windows .exe file. Investigation revealed the file is a PyInstaller-compiled binary that executes malware hidden within a .pyc file. Researchers named the malware MonetaStealer. The malware contains limited capabilities and lacks anti-analysis/persistence mechanisms. Researchers believe it is still in its very early development phase and relies heavily on AI code. MonetaStealer maintains a zero-detection rate on VirusTotal as of the time of writing.

Investigating Shai-Hulud: Inside the NPM Supply Chain Worm

On August 26, 2025, attackers exploited a GitHub Actions injection vulnerability inside Nx’s workflow, using a manipulated pull request title to run shell commands and extract the company’s NPM publishing token. With that access, they published malicious versions of trusted Nx packages. Once installed, those packages hijacked local AI command line tools to scan victim systems for credentials, SSH keys, and crypto wallets.

CrashOne - A Starbucks Story - CVE-2025-24277

On a cold autumn day in Budapest in 2024, I met independent security researcher Gergely Kalman at a local Starbucks to swap ideas, dead ends, and updates on our research. Over coffee, we started talking about crash logs, and that’s when we stumbled onto something big.

The Top Cyber Threats Facing SMBs in 2025

Small and midsize businesses (SMBs) are under siege. Attackers know these organizations often run lean IT teams with limited budgets, making them prime “path of least resistance” targets.

Building a Smarter OS Update Strategy with Declarative Device Management

Managing operating system updates across an Apple device fleet has always been a balancing act. Push updates too aggressively, and you risk disrupting critical workflows. Move too cautiously, and you expose your organization to security vulnerabilities. The solution? A well-designed N-1 OS update strategy powered by declarative device management (DDM).

The Great Tool Reckoning: 3 Trends Driving the Move Toward Platform Consolidation

A wake-up call from 1,000+ IT professionals: The pursuit of "perfect" tools is creating imperfect teams.

The New Face of IT: More Ops, Less Headcount

The IT department of 2025 looks nothing like the help desk of 2015.