Silent Replacement of Trusted macOS App Executables

Summary

Like our research? Try Psylo. Psylo is our privacy-first browser for iOS and iPadOS, with a built-in proxy network, per-tab isolated web sessions, and anti-fingerprinting. Using it helps fund more work like this. Read why we built it → Download Psylo → Affected Platforms# macOS Tahoe 26.0.0 – 26.5.2 macOS Golden Gate 27 beta 1, 2, 3, and 4 Earlier versions of macOS are likely affected as well, but have not been tested. Summary# macOS provides several safeguards to prevent applications and scripts from tampering with other installed applications. In this post, we show a bug in macOS that allows an attacker to: Silently replace an application’s main executable under /Contents/MacOS/ without triggering an authorization prompt. Relaunch the modified application normally, without displaying any security warnings. Impersonate the trusted application in system permission prompts to request access to Keychain secrets and files protected by Transparency, Consent, and Control (TCC), including those inside ~/Desktop and ~/Documents. The attack requires only code execution as the current user, and does not require elevated privileges. Summary for Non-Technical Readers# We found a macOS security issue that Apple looked into but decided not to fix. If you run a malicious app or script on your Mac, an attacker could: Secretly replace trusted apps you already have installed from the web with malicious versions. Request permissions to access private data on behalf of those trusted apps, including files in places you expect to be private, such as your Desktop or Documents folders, or your Keychain. Replacing a trusted app requires neither your Mac’s password nor any special approval, and it can happen entirely in the background. Accessing protected data still requires your approval, but the macOS system prompts show the trusted app’s name and icon, making the requests appear to come from the real app. Background# macOS Application Bundles# On macOS, apps are distributed as applicatio...