Jamf Threat Labs

https://www.jamf.com/blog/category/jamf-threat-labs/

macOS/Apple-platform threat-research lab. PRIMARY source for PamStealer macOS infostealer (2026-07-02), cited in entry 2026-07-04/pamstealer-macos-infostealer-pam-api-password-validation. Added as candidate 2026-07-04; promote to active after 3 contributing runs. FETCH -> webfetch https://www.jamf.com/blog/category/jamf-threat-labs/ listing, then per-article webfetch for body (article pages resolve 200). | 2026-07-05 admiralty audit: B (HIGH->B), original Apple-platform threat research. Keep candidate for now (single contribution) but promotion-ready: clean fetch history, strong niche relevance. | 2026-07-14 intel run: contributed CrashStealer macOS-infostealer entry (2nd contributing run after PamStealer 2026-07-04), promotion-ready to active on next contribution. | 2026-07-26 weekly quality audit: promoted candidate → active on the documented lifecycle bar (cited by published entries from 4 distinct runs; the bar is 3). The promotion had never been executed because nothing counted contributing runs, the digest now emits sources.promotion_due (tools/run_summary.py). | 2026-09-13 quality audit (G3 broken-recipe duty, closing 2026-09-06 recommendation 3): STILL BROKEN, same diagnosis as reliaquest and ibm-xforce: extract, jina and bridge url all return a marketing/nav shell with no drillable dated listing. Not a 403. Left active and NOT demoted; raised as an audit recommendation. At 2 consecutive quiet periods. | 2026-09-20 quality audit (G3 re-probe): NOT dark, contrary to the 2026-09-13 diagnosis. WORKING RECIPE: python3 tools/fetch_source.py url https://www.jamf.com/blog/category/jamf-threat-labs/ returns raw HTML carrying real /blog/<slug> links; per-article `url` auto-falls-back to the reader and returns full text. Newest posts at probe time were July to 2026-09-03, i.e. genuinely none in the audit window.