Researchers find a gap in macOS Gatekeeper

Downloaded macOS apps such as Brave, Slack, Signal, and Visual Studio Code can allegedly be replaced with malicious “evil twins” after they have been opened once, according to security researchers Talal Haj Bakry and Tommy Mysk.

Apple says Gatekeeper checks software downloaded outside the App Store to confirm that it comes from an identified developer, has been notarized, and has not been altered. But Bakry and Mysk say they found a gap that lets an attacker “silently replace the main executable of any application downloaded from the web without requiring elevated privileges.”

The attack is not remotely exploitable on its own. It requires the attacker to gain user-level code execution—for example, through a malicious app or script. The researchers demonstrated that a downloaded app could be archived with the tar utility, deleted, and replaced with a malicious version without macOS requiring Gatekeeper to reauthorize it.

The technique does not work against Mac App Store apps, the researchers told The Register, because those applications are owned by root and cannot be overwritten by a process running with ordinary user privileges.

How the Gatekeeper bypass works

The target must be a web-downloaded app that has already been opened once, allowing Gatekeeper to complete its initial checks. Bakry and Mysk speculate that macOS’s cached trust data may be involved:

Recommended reading

OpenAI’s agent attack came with safeguards removed

“When you open the app for the first time and it passes all validation checks, macOS marks the app as trusted and saves this data.”

They said macOS detects that the app bundle has changed but appears to accept the cached trust result after the bundle is archived and restored. Potential ways to obtain the required user-level access include a terminal command a victim is tricked into running, a malicious application, an AI-agent prompt injection, or a supply-chain compromise involving npm, Homebrew, or another package manager.

A replacement app could then display convincing prompts that users trust because they appear to come from a familiar application. The researchers reported the issue to Apple, which reportedly closed it. Apple said the technique does not modify the signed executable; instead, it overwrites the entire bundle, creating what it considers a locally built app. Apple reportedly regards resulting access to Keychain or TCC-protected directories as requiring authorization prompts—and social engineering those prompts as out of scope. Apple did not respond to a request for comment.