> Infostealers for Mac are a thing (Uber is a mac heavy shop I hear) Block unknown executables on company machines. Google developed Santa to protect themselve

> Infostealers for Mac are a thing (Uber is a mac heavy shop I hear) Block unknown executables on company machines. Google developed Santa to protect themselves: https://github.com/google/santa https://github.com/google/santa > and that's all it takes to steal cookies and tokens post-mfa, Make post-MFA cookies and tokens short-lived. Require MFA re-authentication at least daily. > or why even bother with that, if you're running code just make it a reverse shell. All outbound connections should be strictly monitored, especially from production servers, which should have no ability to connect to the Internet at all. With modern dependency management, that's harder for build servers, but still doable.