Exploring the world with my sword of debugger : )
Joined August 2013
- Tweets 304
- Following 265
- Followers 5,331
- Likes 3,448
39 Photos and videos
Mickey Jin retweeted
Jun 8
IMO Mysk is not trustworthy. They tried to hype low impact vulns as critical in the past (HTTP icon download). Also... duplicates happen, and Apple always credits you for those. If you can't trust the vendor's decision about first submitter, then don't submit. I did cross check a few of these duplicates with researchers in the past, and Apple was always right.
1
2
17
1,187
Mickey Jin retweeted
codecolor.ist/grapefruit/
Friday night product launch is not a good idea, but here is v1.0.0 release
npm i -g igf
Prebuilt single execuatbles are also available on GitHub release page. Please give a 🌟 if you like this tool, maybe I can beg for some free coding tokens with it
3
26
97
11,023
Mickey Jin retweeted
Today, Project Zero released a 0-click exploit chain for the Pixel 9. While it targets the Pixel, the 0-click bug and exploit techniques we used apply to most other Android devices.
projectzero.google/2026/01/p…
7
236
1,021
117,070
Mickey Jin retweeted
Jan 5
Holiday Project 👨🏻💻🎄
Interested in macOS malware? Have a read!
🎉 A decade of Mac malware research 🎉
Just published our 10th annual “The Mac Malware of <year>” report ...2025 edition!
For each new sample of 2025, covers:
🔎 IoCs 💉 Infection 💾 Persistence 📡 Capabilities ☣️ Samples for download
Dive in 👇
objective-see.org/blog/blog_…
11
38
8,858
Mickey Jin retweeted
18 Dec 2025
Introducing DirtyDict. A series of vulnerabilities found by me and @patch1t.
Most of this is my perspective, but Mickey did give me permission to share some details about one of his bugs.
Enjoy!
wts.dev/posts/dirtydict/
3
15
62
8,353
Mickey Jin retweeted
5 Dec 2025
🎉 My new blog post is about a PackageKit vulnerability I learned from @p1tsist1p 's blog posts.
🍎🐛macOS LPE via the .localized directory
I tried convincing Apple to universally fix it with no luck.
Go hunt for vulnerable pkg installers! There is a ton :-( Happy Friday!
theevilbit.github.io/posts/l…
3
31
129
12,823
Mickey Jin retweeted
23 Oct 2025
A really thorough overview of the research: github.com/trailofbits/explo…
11
36
5,880
Mickey Jin retweeted
15 Oct 2025
The slidedeck to our talk, Crash One: A Starbucks Story - CVE-2025-24277, with @gergely_kalman from @hexacon_fr and @objective_see #OBTS is available from the link below.
It was a macOS vulnerability impacting the crash reporting process where we could achieve LPE and sandbox escape.
theevilbit.github.io/talks_w…
1
25
88
10,890
Mickey Jin retweeted
10 Sep 2025
Excited to share our research on ChillyHell, a modular macOS backdoor targeting officials in Ukraine. Check out our write-up for more details.
jamf.com/blog/chillyhell-a-m…
2
10
32
4,901
4 Sep 2025
For those missing the talk,
Blog: jhftss.github.io/Exploiting-…
Slides: github.com/jhftss/jhftss.git…
6
42
165
18,103
A tiny timing flaw in Apple’s core file-copy APIs can put millions of devices at risk 📂🍏
Despite warnings, Apple thought it was “too hard to exploit”—until Mickey Jin developed an exploit that steals secrets in privileged services
👉nullcon.net/berlin-2025/spea…
#NullconBerlin2025
10
45
3,920
Thank you @helpnetsecurity to mention us 👍 awesome research by @tsunek0h
#macOS #applesecurity #NullconBerlin2025
helpnetsecurity.com/2025/09/…
1
3
15
1,727
🚨 New blog post: ELEGANTBOUNCER - Catch iOS 0-click exploits without having the samples.
Features iOS backup forensics & messaging app scanning for iMessage, WhatsApp, Signal, Telegram & Viber attachments.
🔗 Link -> msuiche.com/posts/elegantbou…
8
62
198
37,488
🍏 #AppleDevelopers use NSFileManager thinking it’s safe — but @patch1t found a race condition once thought “impossible to exploit.”
At #NullconBerlin2025, he’ll show how it works, why CVE-2024-54566 failed, and Apple’s final fix.
👉 nullcon.net/berlin-2025/spea…
#iOS #applesecurity
1
3
23
4,212
Mickey Jin retweeted
22 Aug 2025
Brief info and POC for this week's Apple 0click iOS 18.6.1 RCE bug CVE-2025-43300 github.com/b1n4r1b01/n-days/…
15
217
806
131,353
Mickey Jin retweeted
1 Aug 2025
We released our Fuzzilli-based V8 Sandbox fuzzer: github.com/googleprojectzero…
It explores the heap to find interesting objects and corrupts them in a deterministic way using V8's memory corruption API. Happy fuzzing!
2
72
293
24,719
Mickey Jin retweeted
31 Jul 2025
Launch constraints are annoying as a security researcher. What if you didn't have to worry about them?
wts.dev/posts/bypassing-laun…
5
9
40
5,778