Tonmoy Jitu
Tonmoy Jitu is a cybersecurity professional whose work sits at the intersection of incident response and hands-on threat research. They began as an Incident Responder, handling active intrusions and enterprise-scale containment. That experience led them into dedicated threat research at Sophos, where they spend much of their time tearing down malware, reversing suspicious binaries, and chasing samples that sit in a grey zone: low or inconsistent detection, weak reputation coverage, or behavior that only makes sense once you read the file end to end.
Tonmoy is especially interested in how those samples propagate in the wild, how they evade common checks, and what static and behavioral evidence actually holds up under scrutiny. They also write on their own time about emerging malware and threats that tend to fly under the radar: odd tooling, quiet campaigns, and binaries that do not map cleanly to familiar family names or mainstream coverage.
Session
This talk presents a technical analysis of a multi-stage macOS attack chain attributed with moderate-high confidence to the Lazarus/BlueNoroff cluster, targeting cryptocurrency users across a broad range of blockchain ecosystems.
The sample is notable for a few reasons. The delivery mechanism is deliberately designed to sidestep macOS Gatekeeper without relying on stolen certificates or notarization bypasses. The credential theft component demonstrates detailed knowledge of Chromium internals across all three major platforms. And an operational security failure on the server side left the C2's full API schema publicly accessible, providing an unusually complete picture of the operator workflow without requiring any server-side access.
The talk covers the full attack chain from dropper to exfiltration, the tradecraft decisions that make this campaign effective against modern macOS defences, infrastructure attribution, and detection opportunities for defenders.