A newly discovered macOS Gatekeeper vulnerability allows attackers to silently replace trusted applications with malicious code without triggering system security warnings. Discovered by security researchers Talal Haj Bakry and Tommy Mysk, this exploit targets apps downloaded outside the Mac App Store, manipulating the archiving process to bypass Apple's notarization checks. The vulnerability highlights a critical blind spot in how macOS handles previously approved software.
The exploit requires a specific sequence of events to execute successfully. First, the targeted app must have been downloaded from a developer's website, installed, and launched at least once. Second, the attacker must already possess remote or physical access to the machine. "A vulnerability in macOS allows an attacker to silently replace the main executable of any application downloaded from the web without requiring elevated privileges," the researchers explained. By archiving the app using a.tar file, deleting the original, and extracting the archive with a modified executable, the malware can launch unchecked.
Because macOS Gatekeeper verifies the entire app package during its initial launch rather than checking every internal element upon subsequent unarchiving, the system still views the modified app as legitimate. When the compromised app prompts the user for permission to access sensitive files and folders, the dialog box appears entirely authentic. Apple has reportedly dismissed the findings, arguing that the exploit relies heavily on social engineering and requires the system to be compromised beforehand.
How to Protect Your System from the Gatekeeper Bypass
- A Mac running current macOS versions.
- Applications downloaded from third-party developer websites.
- Download applications exclusively from the Mac App Store whenever possible.
This ensures the app is installed system-wide with stricter permission structures that are immune to this specific.tar archive exploit. - Restrict physical and remote access to your Mac by using strong passwords and disabling unnecessary sharing services.
This prevents bad actors from gaining the initial user-level code execution required to perform the app-swapping technique. - Scrutinize unexpected permission prompts from apps you already installed and launched previously.
This helps you catch a modified app attempting to gain elevated privileges to access sensitive files and folders.
The Fine Line Between Social Engineering and System Flaws
Apple's dismissal of this vulnerability as mere social engineering highlights a growing friction between theoretical security and real-world user behavior. While it is true that the attacker needs prior access - meaning the system is already compromised - relying on users to spot a fake permission prompt from an app they genuinely trust is a dangerous gamble. Users are conditioned to click "Allow" when a familiar application asks for access, making this exploit highly effective in practice.
The researchers' suggestion to force Gatekeeper to re-verify unarchived apps as new installations is a low-friction fix that Apple should implement in a future macOS update. Until then, power users who rely heavily on web-downloaded software must remain hyper-vigilant about their local network security and physical device access. A compromised system is bad enough, but allowing malware to masquerade as trusted software gives attackers the keys to the kingdom.
