cyber.hendryadrian.com
Interesting Stuff · huntress.com

How Mac Malware Adapts to Apple’s Built-In Security Protections

· Original article ↗

Summary

A Huntress episode recap explains how macOS malware adapts to persistence controls, TCC permissions and Gatekeeper, and notes new TCC event visibility in macOS 15.4.

Key points

  • macOS malware uses Launch Agents and Launch Daemons for persistence; attackers also use cron jobs and app replacement to evade or sidestep Background Task Management (BTM).
  • BTM tracks persistent items, alerts users and shares endpoint security events with third-party tools, but does not directly cover cron jobs loaded in certain ways.
  • TCC prompts users for app permissions, but alert overload and mismatches between MDM settings and what System Settings displays can create usability and visibility issues.
  • As of macOS 15.4, Apple’s Endpoint Security framework reports TCC permission changes after they occur; pre-authorization inspection is not yet available.
  • Apple has tightened Gatekeeper prompts for unsigned software, limiting users to dismissing the warning or moving the app to the Trash.
  • The recap describes attackers porting malware to macOS and using AppleScript to imitate native prompts and steal credentials.

Article Details

Topic
macOS malware and changes to Apple security protections, including persistence, TCC, and Gatekeeper

CVE

CVE-2021-30713(from stealing victims’ app information to taking screenshots) was previously found exploiting CVE-2021-30713, a vulnerability allowing threat actors to bypass the TCC framework, for instance.

People

Patrick WardleFounder of DoubleYou and Objective-See; discussed macOS security protections and malware with Stuart Ashenbrenner.Stuart AshenbrennerHuntress macOS researcher who discussed macOS security protections and malware with Patrick Wardle.

Threat Actors

LockBitRansomware group that the article says has experimented with a macOS ransomware variant.

Malware

AdloadMore macOS malware variants have cropped up over the years, ranging from frustrating adware (like Adload) to insidious spyware (like LightSpy).LightSpyMore macOS malware variants have cropped up over the years, ranging from frustrating adware (like Adload) to insidious spyware (like LightSpy).PoseidonInfostealers like Poseidon are abusing the AppleScript framework—a scripting language that offers the capability to automate tasks—to simulate prompts that mimic native Apple prompts, with the goal of stealing end userShlayerThreat actors behind macOS malware like the Shlayer adware dropper have used this weakness in their attacks.XCSSETXCSSET, which is macOS malware that was uncovered a few years ago and has various capabilities (from stealing victims’ app information to taking screenshots) was previously found exploiting CVE-2021-30713, a

Vendors

AppleApple has taken several steps over the years to build security measures into its platform, including Gatekeeper and the Transparency Consent and Control (TCC) framework.

Products

Background Task Management (BTM)Apple has specifically tracked persistent items in macOS through Background Task Management (BTM), which was introduced in 2022 and keeps tabs on persistence items in a BTM database.Endpoint SecurityBTM creates macOS alerts for end users if it detects persistent items, and these are also broadcast as endpoint security events to third-party security tools.GatekeeperApple has taken several steps over the years to build security measures into its platform, including Gatekeeper and the Transparency Consent and Control (TCC) framework.macOSYes, Windows devices are still very much a business favorite—but the adoption of macOS devices has been steadily ticking upward.Transparency, Consent, and Control (TCC)Apple has taken several steps over the years to build security measures into its platform, including Gatekeeper and the Transparency Consent and Control (TCC) framework.

Related Articles