Хакеры нашли новый способ отключить защиту Mac: угроза для пользователей

XM Cyber ​​researchers have discovered a vulnerability in macOS that allows standard users (without administrator rights) to disable enterprise security tools such as CrowdStrike and Kandji. It does not require complex kernel exploits and leaves few traces.

At the end of June 2026, cybersecurity experts from XM Cyber ​​discovered a new attack technique on Mac computers, xrust is concerned. It allows you to bypass the built-in trust mechanisms of macOS and disable professional security software. This discovery is especially relevant for Russian users and companies that actively use Apple technology in a corporate environment.

What is the essence of vulnerability?

Researchers have discovered a problem in the trust relationships system of the macOS operating system. An attacker who already has access to the computer (via phishing, malicious link, or physical access) can install a legitimate signed application. After macOS caches its fingerprint of trust (CDHash), the attacker modifies the application package by adding malicious code.

The system continues to trust the application, which allows you to call privileged functions through XPC (interprocess communication mechanism). As a result, it is possible to disable security sensors such as CrowdStrike Falcon Sensor or Kandji MDM system agents, without entering an administrator password and without bypassing System Integrity Protection (SIP) — a key protection of macOS.

The XM Hunter tool, developed by XM Cyber ​​as a proof-of-concept, demonstrates this technique. It will be presented at the Black Hat conference in August 2026. The tool will also help you scan for vulnerable applications.

Vendors' reaction

CrowdStrike quickly responded by releasing updates with additional detections and preventions. The company has confirmed that the technology is exploiting the macOS problem, and now their sensor is better protected. Kandji also made changes and registered the related vulnerability as CVE-2026-39118. Apple had not publicly commented on the finding at the time of publication, although researchers notified the company.