Security Flaw in macOS Gatekeeper Allows Malicious App Swapping
Researchers Expose macOS Gatekeeper Flaw Allowing Silent App Swaps
Security researchers Talal Haj Bakry and Tommy Mysk have identified a structural gap in Apple’s macOS Gatekeeper defenses, demonstrating that downloaded applications running at least once can be silently swapped with malicious versions without requiring elevated privileges. According to the Apple support documentation, Gatekeeper is designed to verify that software downloaded from outside the App Store originates from an identified developer, is notarized to be free of known malicious content, and remains unaltered. However, the new findings show that the initial validation phase can be bypassed if an app bundle is archived and restored locally, raising critical questions for enterprise IT administrators.
The Tech TL;DR:
- The Vulnerability: Security researchers Talal Haj Bakry and Tommy Mysk discovered that once macOS apps downloaded from the web run for the first time, their executable binaries can be replaced via file archiving utilities without triggering Gatekeeper re-authorization.
- The Scope: The bypass affects popular web-downloaded applications such as Brave, Slack, Signal, and Visual Studio Code, but does not impact Mac App Store binaries protected by root ownership.
- The Response: Apple reportedly closed the issue after disclosure, classifying the attack vector as a local system modification via archive/restore operations rather than a direct code-signing violation.
Anatomy of the Gatekeeper Bypass and Cache Retention
As detailed by the Mysk team, the exploit requires prior user-level code execution access, meaning an attacker must already possess a foothold on the target machine through a malicious script, command-line tool, prompt injection attack against an AI agent, or a supply chain compromise via package managers like npm or Homebrew. Once user-scoped code execution is established, the attack relies on archiving a validated application bundle using tar, deleting the original, and extracting a modified or malicious executable in its place.
When a user opens an application for the first time and it clears all validation checks, macOS marks the application as trusted and persists this metadata. When the binary is subsequently modified, the operating system attempts an integrity check, but the cached value of the trust state causes the validation to pass despite the altered bundle.
Because the technique involves archiving and restoring the app bundle, the operating system treats the resulting files as locally built app bundles. Locally built binaries fall outside standard macOS quarantine guards, though subsequent access to Keychain or TCC-protected directories still requires standard system authorization prompts.
Technical Mitigation and Endpoint Verification
For instance, teams can regularly verify application bundle checksums against known-good manifests using standard command-line hashing utilities:
find /Applications -name "Contents/MacOS/*" -type f -exec shasum -a 256 {} ;
*Disclaimer: The technical analyses and security protocols detailed in this article are for informational purposes only. Always consult with certified IT and cybersecurity professionals before altering enterprise networks or handling sensitive data.*