Researchers have uncovered a macOS vulnerability that lets an attacker replace the main executable of apps downloaded from the web without needing elevated privileges, potentially running attacker-controlled code when the app is relaunched.

The risk centers on web-downloaded apps, with cautions to handle such software carefully; App Store apps remain protected by stricter controls and are not affected.

The vulnerability does not affect Mac App Store apps because they are owned by root and protected from user-level overwrites; however, common web-downloaded apps like Brave, Slack, Signal, and Visual Studio Code could be targeted.

Researchers suggest next steps including tighter Gatekeeper and code-signing protections and improved handling of archived or modified app bundles after initial trust is established.

Apple’s stance and remediation notes are discussed, with researchers proposing mitigations or workflow changes to guard against this class of attack.

If a doppelganger app is in place, it can exploit user trust by presenting prompts that look legitimate and originate from a known app, heightening the risk of credential theft or data access.

The vulnerability was reported by The Register, which is cited in coverage of the issue.

Attack implications include covertly replacing trusted applications to request access to private data and permissions, including files in Desktop or Documents and Keychain access.

The exploit hinges on macOS signing and notarization methods, where the altered unarchived app may be treated as the same application, potentially avoiding fresh trust prompts.

Potential attack vectors include abusing command-line tools, malicious downloads, prompt injections through AI agents, copy-paste prompts, or supply chain/package manager attacks to achieve initial code execution.

Gatekeeper requirements involve developer verification, notarization, and ensuring apps aren’t altered when first opened from outside the App Store.

High-profile apps like Slack, Signal, and Visual Studio Code could be affected, depending on the attacker’s ability to execute code at the user level.