Ethical Hacking News
Researchers have discovered a critical flaw in macOS Gatekeeper's code signing rituals, leaving users vulnerable to attacks that can swap legitimate apps with evil twins. The finding has raised serious questions about the thoroughness of Apple's security measures and highlights the need for ongoing security research and development in the fight against cybercrime.
An attack was discovered on Apple's Gatekeeper security feature that allows malicious software to swap legitimate macOS apps with fake versions.The flaw lies in Gatekeeper's code signing rituals, which can be bypassed if an attacker has user-level code execution capabilities.Gatekeeper relies on cached values to verify app integrity, making it vulnerable to manipulation by attackers.Users can be tricked into installing malicious apps or running scripts that exploit Gatekeeper's vulnerabilities.The attack creates a cat-and-mouse game between the attacker and the user, with the attacker constantly updating the malicious app to stay one step ahead.Apple reportedly closed the issue after researchers reported their findings, but it highlights the need for ongoing security research and development.Users must be vigilant and take steps to protect themselves from these types of attacks, such as verifying app authenticity and keeping software up-to-date.
Apple's Gatekeeper has long been touted as a robust security measure, designed to protect users from malicious software that has been downloaded from the internet and run on their Macs. However, recent research by Talal Haj Bakry and Tommy Mysk has revealed a critical flaw in this security net, leaving users vulnerable to attacks that can swap legitimate macOS apps with evil twins.
The researchers discovered that Gatekeeper's code signing rituals are not as foolproof as they seem. According to the study, an attacker needs only to have means of user-level code execution available, such as a malicious app or downloaded script, in order to silently replace the main executable of any application downloaded from the web without requiring elevated privileges. This is possible because Gatekeeper relies on cached values to verify the integrity of apps, which can be manipulated by an attacker to bypass validation.
The attack scenario requires an app that has been run once and has completed its initial validation phase. At this point, Gatekeeper marks the app as trusted and saves this data in a cache. Later, when the user modifies the executable, macOS detects a change in the bundle and attempts to revalidate its integrity. However, the cached value of trust causes macOS to pass validation even though the bundle has changed.
This means that an attacker can use various techniques to gain access to Gatekeeper's vulnerabilities, including exploiting tools installed through the command line, convincing users to copy and paste commands into their terminal, downloading and running malicious apps, prompt injection attacks on AI agents, or supply chain attacks via npm, brew, or other package managers.
Once a doppelganger version of an app is in place, it can magnify its mischief by presenting deceptive prompts that users are more likely to trust because they appear to come from a known app. This creates a cat-and-mouse game between the attacker and the user, as the attacker constantly updates the malicious app to stay one step ahead.
The researchers reported their findings to Apple, which reportedly closed the issue. However, the incident raises serious questions about the thoroughness of Gatekeeper's defenses and highlights the need for ongoing security research and development in the fight against cybercrime.
In response to these findings, it is essential for users to be aware of the potential risks associated with downloaded macOS apps and to take steps to protect themselves from these types of attacks. This includes verifying the authenticity of apps before running them, keeping software up to date, and being cautious when interacting with unknown or suspicious applications.
As Apple continues to evolve its security measures, it is crucial that users remain vigilant and informed about emerging threats. The incident highlights the importance of ongoing collaboration between researchers, developers, and users in the pursuit of secure software development and user protection.
Related Information:
https://www.ethicalhackingnews.com/articles/Exploiting-the-Weaknesses-of-macOS-Gatekeeper-A-New-Vulnerability-in-the-App-Stores-Security-Net-ehn.shtml
https://www.theregister.com/security/2026/07/24/researchers-replace-downloaded-macos-apps-with-evil-twins-apple-shrugs/5277858
Published: Thu Jul 23 19:15:07 2026 by llama3.2 3B Q4_K_M
