Jamf Threat Labs

https://www.jamf.com/blog/category/jamf-threat-labs/

macOS/Apple-platform threat-research lab. PRIMARY source for PamStealer macOS infostealer (2026-07-02), cited in entry 2026-07-04/pamstealer-macos-infostealer-pam-api-password-validation. Added as candidate 2026-07-04 — promote to active after 3 contributing runs. FETCH -> webfetch https://www.jamf.com/blog/category/jamf-threat-labs/ listing, then per-article webfetch for body (article pages resolve 200). | 2026-07-05 admiralty audit: B (HIGH->B) — original Apple-platform threat research. Keep candidate for now (single contribution) but promotion-ready: clean fetch history, strong niche relevance. | 2026-07-14 intel run: contributed CrashStealer macOS-infostealer entry (2nd contributing run after PamStealer 2026-07-04) — promotion-ready to active on next contribution. | 2026-07-26 weekly quality audit: promoted candidate → active on the documented lifecycle bar (cited by published entries from 4 distinct runs; the bar is 3). The promotion had never been executed because nothing counted contributing runs — the digest now emits sources.promotion_due (tools/run_summary.py).