patrick wardle on Twitter: "macOS malware often (ab)uses APIs such as NSCreateObjectFileImageFromMemory, NSLinkModule etc) to execute in-memory payloads. Apple has recently updated dyld3 (+these APIs), such that the in-memory payload is now first/always written out to disk 💾 See: https://t.co/vDuXLs6LXD https://t.co/ALyFKSGRco" / Twitter
https://twitter.com/patrickwardle/status/1547967373264560131