New macOS privilege-escalation technique allows attackers to bypass enterprise security tools

Summary

Researchers at XM Cyber have discovered a novel macOS privilege-escalation technique that allows standard-privilege users to disable enterprise security tools (including EDR and MDM solutions) and invoke privileged functions without needing administrator credentials. The exploit works by manipulating how macOS establishes and validates application trust information, enabling attackers to impersonate trusted application components and silently perform privileged actions. This vulnerability poses a significant threat to enterprise environments relying on macOS security tools.

Source

B

bskyNew macOS privilege-escalation technique allows attackers to bypass enterprise security toolsdarkreading.com