Loading story…
Security researchers Talal Haj Bakry and Tommy Mysk reported that macOS Gatekeeper can be bypassed after a web-downloaded application has been launched once, allowing an attacker with user-level code execution to replace the original app with a malicious lookalike without triggering a new authorization check. The technique reportedly works by archiving a previously validated application bundle and swapping in a malicious replacement, enabling silent substitution of commonly downloaded software such as Brave, Slack, Signal, and Visual Studio Code.
Apple's documentation says Gatekeeper is designed to verify that software from the internet is trusted before it runs, but the researchers said that trust is not re-evaluated in this replacement scenario once the app has already been approved. Apple reportedly closed the report, arguing that the proof of concept replaces the entire app bundle as a locally built app and therefore falls outside the protections it applies to downloaded software; the issue does not affect Mac App Store apps, but it raises concerns about post-installation tampering of third-party macOS applications.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Apple reportedly closed the researchers' report and said the proof of concept replaces the entire app bundle as a locally built app, which it does not treat as covered by the same macOS protections. Apple's support documentation describes Gatekeeper checks for software downloaded from the internet, including notarization and first-launch verification behavior.
Talal Haj Bakry and Tommy Mysk reported that macOS Gatekeeper can be bypassed for apps downloaded from the web after they have been run once, allowing a malicious replacement of the app without renewed authorization. The technique requires user-level code execution and does not affect Mac App Store apps, but could impact commonly downloaded apps such as Brave, Slack, Signal, and Visual Studio Code.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetheregister.com
Open sourcesupport.apple.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new variant of the MacSync Stealer malware has emerged, leveraging a code-signed and notarized Swift application to bypass Apple's built-in malware protections. Security researchers from Jamf identified that this variant is distributed as a disk image containing a Swift app, which is both signed and notarized, allowing it to evade standard macOS security checks. Once executed, the app retrieves an encoded script from a remote server and runs it via a helper executable, effectively installing the stealer without requiring the user to interact with the Terminal or bypass typical security warnings. This approach marks a significant evolution from previous MacSync Stealer tactics, which relied on social engineering to trick users into running commands in Terminal or using "ClickFix"-style techniques. The new method removes the need for direct user intervention, increasing the likelihood of successful infections. The installer was observed to be distributed via a website and, at the time of analysis, its code signature had not been revoked by Apple. Researchers also noted that similar distribution methods are being adopted by other Mac-focused infostealers, indicating a broader trend in macOS malware delivery.
Jun 29, 2026
Threat actors are increasingly targeting macOS users with **infostealers** and distribution-as-a-service models, reflecting a broader “gold rush” in Apple-focused malware development. Reporting highlights macOS stealers targeting browser credentials and cryptocurrency assets (including seed phrases) and notes tactics to evade Apple controls such as obtaining valid Apple developer signatures to bypass *Gatekeeper*; one cited example is *MacSync* being notarized and signed under Team ID `GNJLS3UYZ4`. The same reporting describes ecosystem-scale enablement, including large-scale compromise of WordPress sites for distribution and novel command-and-control approaches such as using blockchain smart contracts (e.g., on **BNB Smart Chain**), alongside paid-traffic abuse (e.g., promoting malicious AI chat content via ads) to push stealer payloads. Separately, a Darktrace-described investigation details a **multi-stage macOS malware** campaign that prioritizes *social engineering* over exploitation to defeat Apple’s **Transparency, Consent, and Control (TCC)** privacy framework. Victims are lured via phishing to open an AppleScript masquerading as a document (`Confirmation_Token_Vesting.docx.scpt`), which displays a fake “Compatibility” error and instructs the user to launch a “Compatibility Wizard” (e.g., using a keyboard shortcut) that effectively tricks them into authorizing execution and granting access. Together, the reporting indicates macOS threats are increasingly succeeding by combining credential/crypto theft objectives with user-prompt manipulation and trust-abuse techniques rather than relying on kernel or sandbox escapes.
Jun 29, 2026
Researchers at XM Cyber disclosed a macOS privilege-escalation technique that allows a standard, non-administrative user to disable enterprise security software and invoke privileged functions without administrator credentials or kernel exploits. The attack chain abuses legitimate macOS behavior by combining weakly validated XPC connections, malicious payload injection into Interface Builder NIB files, and a newly described misuse of the kernel code-signing trust cache, which can continue trusting an application's `CDHash` after a legitimately signed app has run. XM Cyber said it successfully used the method to silently unload or permanently deactivate **CrowdStrike Falcon Sensor**, **Kandji MDM**, and a third unnamed EDR product without triggering alerts. Kandji addressed the issue in an updated agent release and assigned **`CVE-2026-39118`**, CrowdStrike reportedly paid a bug bounty and added detections while disclosure continues, and another vendor is developing a patch; XM Cyber also warned that Apple does not plan to remediate the underlying macOS design issue, leaving software vendors to implement their own mitigations.
Jun 29, 2026