TCC Bypass Archives • Daily CyberSecurity

Beyond Gatekeeper: How Sapphire Sleet’s AppleScript Trap Hijacks macOS and Crypto Wallets

Beyond Gatekeeper: How Sapphire Sleet’s AppleScript Trap Hijacks macOS and Crypto Wallets

Do Son April 21, 2026

Microsoft uncovers Sapphire Sleet's macOS campaign. Using fake recruiters and AppleScript, they bypass TCC to steal crypto wallets, Telegram, and SSH keys.

The “Compatibility” Trap: New Mac Malware Tricks Users into Bypassing TCC OSX/Amos Stealer Electron ASAR Trojan MioLab Malware macOS Security MacSync Stealer macOS Malware ambar-src npm Malware Supply Chain Typosquatting Matryoshka Mac Malware ClickFix Crypto Scam Infostealer Evolution macOS Malware Predator Spyware Intellexa Anti-Analysis XCSSET macOS Malware, Xcode Supply Chain

OSX/Amos Stealer Electron ASAR Trojan MioLab Malware macOS Security MacSync Stealer macOS Malware ambar-src npm Malware Supply Chain Typosquatting Matryoshka Mac Malware ClickFix Crypto Scam Infostealer Evolution macOS Malware Predator Spyware Intellexa Anti-Analysis XCSSET macOS Malware, Xcode Supply Chain

The “Compatibility” Trap: New Mac Malware Tricks Users into Bypassing TCC

Do Son February 9, 2026

Darktrace finds Mac malware using a fake "Compatibility Wizard" to trick users. The AppleScript attack bypasses TCC to drop a Node.js backdoor.

New TCC Bypass (CVE-2025-43530) Exposes macOS to Unchecked Automation macOS TCC Bypass, CVE-2025-43530

New TCC Bypass (CVE-2025-43530) Exposes macOS to Unchecked Automation

Do Son January 6, 2026

Researcher Mickey Jin uncovers CVE-2025-43530, a critical TCC bypass in macOS allowing attackers to hijack user data via accessibility tools.

CVSS 9.8 Flaw in macOS Allows Apps to Access Protected User Data, PoC Available macOS vulnerability, file copy APIs

CVSS 9.8 Flaw in macOS Allows Apps to Access Protected User Data, PoC Available

Do Son September 9, 2025

A critical flaw (CVSS 9.8) in macOS file copy APIs allows apps to bypass sandboxing and TCC protections to access protected user data. A PoC is public.

PoC Available: macOS Sequoia Flaw Allows Keychain Dump and TCC Bypass (CVSS 9.8) macOS Sequoia, gcore vulnerability

PoC Available: macOS Sequoia Flaw Allows Keychain Dump and TCC Bypass (CVSS 9.8)

Do Son September 5, 2025

A critical macOS flaw (CVE-2025-24204) in gcore allows a user to read any process memory and bypass TCC. A PoC is public, and patching is urgent.

Critical macOS Flaw (CVSS 9.8) Bypasses TCC Without Root Access: PoC Published macOS TCC Bypass, InstallAssistant Vulnerability

Critical macOS Flaw (CVSS 9.8) Bypasses TCC Without Root Access: PoC Published

Do Son August 11, 2025

A critical flaw (CVE-2025-24103) in macOS InstallAssistant allows a normal user to bypass TCC, exposing private data. A PoC is public, urging users to update to 15.3.

Microsoft Uncovers “Sploitlight”: macOS Flaw (CVE-2025-31199) Bypasses TCC, Leaking Apple Intelligence Data macOS Vulnerability, TCC Bypass

Microsoft Uncovers “Sploitlight”: macOS Flaw (CVE-2025-31199) Bypasses TCC, Leaking Apple Intelligence Data

Do Son July 29, 2025

Microsoft discovered "Sploitlight" (CVE-2025-31199), a macOS flaw exploiting Spotlight plugins to bypass TCC, leading to private data exfiltration, including Apple Intelligence cached info.

CVE-2024-55950: Tabby Terminal Emulator Vulnerability Exposes macOS Users to Privacy and Security Risks TCC Bypass - CVE-2024-55950

CVE-2024-55950: Tabby Terminal Emulator Vulnerability Exposes macOS Users to Privacy and Security Risks

Do Son December 29, 2024

Discover the high-severity vulnerability CVE-2024-55950 in Tabby, a widely used terminal emulator for Windows, macOS, and Linux.