Silent Replacement of Trusted macOS App Executables
5 hours ago
- macOS allows silent replacement of a trusted app's main executable under /Contents/MacOS/ after archiving and restoring the app bundle, without triggering authorization prompts or security warnings.
- The attack requires only code execution as the current user, no elevated privileges, and works on apps downloaded from the web after their first launch.
- The replaced executable is ad hoc signed and can impersonate the trusted app in system permission prompts to request access to Keychain secrets and TCC-protected files.
- Apple declined to fix the issue, arguing that no Gatekeeper or TCC bypass occurred and that convincing users to approve prompts is social engineering.
- Suggested remediation includes revalidating code signatures when the bundle changes and displaying the developer identity in authorization prompts.
- The issue affects macOS Tahoe 26.0.0–26.5.2 and Golden Gate 27 beta 1–4, with earlier versions likely also affected.