Bring Your Own VM - Mac Edition

This blog post demonstrates a proof-of-concept technique using macOS Big Sur's Virtualization.framework to programmatically create a small ARM64 Linux VM on target macOS devices (including M1), showing entitlement requirements, Swift code to configure and start the VM, cross-compilation of an aarch64 Linux kernel and initrd, and use of a Mythic Poseidon implant inside the VM to pivot—highlighting a potential method for evading AV/EDR by running malicious logic inside a separate virtual environment.