macOS Vulnerability Allows Attackers to Replace Any App With Malicious Code

Researchers Talal Haj Bakry and Tommy Mysk discovered a vulnerability in macOS that allows an attacker to replace already installed apps with malicious versions that look indistinguishable from the real app.

The exploit doesn't require any elevated privileges on the system or even a user password, meaning it can be done without triggering any system prompts that might alert you something is going on. It does require that an attacker already have code execution as the current user as a prerequisite, which could be achieved using another malicious app or script.

When the malicious version of the app is run, it will appear to you just as the real app would. When it requests permissions such as access to your files or camera, it will show a real system prompt from the real app, but you'll be granting access to the modified app unknowingly.

All versions of macOS 26 are affected, and the researchers say likely earlier versions of macOS are also affected but they haven't confirmed this to be the case.

The bug only works for apps installed from the web; macOS App Store apps are not affected.

The bug relies on some bizarre behavior when archiving .app files using tar.

Apps are typically signed by the app developers. When it's launched for the first time, Gatekeeper prompts you asking if you want to run the app, and if you do, it completes an initial verification and subsequent launches of the app will be allowed.

After this first launch, any attempt to modify the app will be blocked, even with sudo.

However, if you archive the .app file with tar, delete the original app bundle, and extract the archive back where it was, you'll be able to launch the app even though it's a different copy of the original app.

The contents of the app can be modified freely now without triggering any kind of system permission or password prompt.

An attacker from here can alter the app to do whatever they want and when you run it, you'll think you're running the same trusted app you had before.

The new app won't retain any keychain access or permissions you had perviously granted the real app, but when the malicious app prompts you for access to those things, it will be a real system prompt that looks exactly like it's from the real app.

For example, a fake Signal could be planted request access to the real Signal's keychain, tricking you into giving access to your encryption keys.

Mysk says they reported the issue to Apple, but Apple dismissed the report as not requiring a security fix.