Mac Threat Hunting as a Service: Inside Beacon by Jamf Threat Labs

Most security teams know Windows inside out, but not macOS. Beacon by Jamf Threat Labs hunts the Mac malware and attacker activity your team misses. In this episode of Jamf After Dark, hosts Kat Garbis and Josh Thornton talk with Jaron Bradley, Director of Jamf Threat Labs, about the state of the macOS threat landscape in 2026, and a new service that brings dedicated Mac threat hunting to your environment. If you run a Mac fleet and your team's expertise is mostly Windows or Linux, this one's for you. What You'll Learn: Why macOS is now a real target: info stealers, malicious search ads, and fake app installers How Jamf Threat Labs researches malware like GhostClaw and builds detections into Jamf Protect What Beacon is, how telemetry feeds the hunt, and why human analysts review every alert Why dedicated macOS expertise matters when Windows-first tools fall short on Mac CHAPTERS: 0:00 Mac Threats and the Jamf After Dark Crew 1:21 Meet Jaron Bradley: From Incident Response to macOS Threat Hunting 4:15 What Is Jamf Threat Labs? Team, Research and Mission 6:51 The State of the macOS Threat Landscape 7:33 Why Mac Is a Growing Target: Info Stealers and Malicious Ads 9:24 How AI Is Changing Both Attack and Defense 11:40 Jamf Threat Labs Research: GhostClaw, Predator and the Aftermath Tool 13:57 Jamf Protect and MI:RIAM: Real-Time Mac and Mobile Detection 14:43 How Attackers Masquerade Malware on macOS (DPRK Tactics) 17:21 Introducing Beacon by Jamf Threat Labs: What It Is and How It Works 19:37 Why Beacon Exists: macOS Threat Hunting as a Service 25:05 What to Expect as a Beacon Customer: Alerts, Detections and Reports 28:00 Real-World Story: Catching APT Activity on a Mac Fleet 29:25 How to Get Started with Beacon 30:47 Wrap-Up and Credits 🔔 Subscribe for more Apple security content from Jamf: Who This Video Is For: Endpoint security specialists and SecOps analysts responsible for macOS compliance and detection Security stakeholders and CISOs building or scaling a Mac security program IT and security teams whose strength is Windows or Linux but who now manage a growing Mac fleet Resources Mentioned: Beacon by Jamf Threat Labs: jamf.com/blog/beacon-jamf-threat-labs-mac-threat-hunting-service/ Jamf Threat Labs: jamf.com/threat-labs/ Jamf Protect: jamf.com/products/jamf-protect/ Jamf Threat Labs on GhostClaw/GhostLoader: jamf.com/blog/ghostclaw-ghostloader-malware-github-repositories-ai-workflows/ Jamf After Dark is a podcast from Jamf. Reach us at [email protected] with the subject line "attention to the podcast." #macsecurity #endpointsecurity #applesecurity #threatdetection #siem #endpointprotection #threathunting #Jamf