macOS Weaknesses Chained to Silently Disable Endpoint Security Agents
macOS attack chain allows non-admin users to disable endpoint security agents.
XM Cyber has demonstrated a novel attack chain on macOS that enables a standard, non-administrative user to silently disable endpoint security tools like EDR and MDM agents. This technique abuses legitimate macOS behavior, specifically the persistence of the kernel's code-signing trust cache, to inject malicious payloads and invoke privileged XPC methods without triggering alerts or requiring kernel exploits. The attack successfully targeted CrowdStrike Falcon Sensor and Kandji MDM, with CrowdStrike issuing a bug bounty and Kandji releasing a patch.
AI summary of the linked source. Not reviewed by an editor. How this works
Run CrowdStrike?
Get an email when a new story names CrowdStrike, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonXM Cyber revealed a novel macOS attack chain that allows a non-administrative user to silently disable endpoint security tools by abusing the kernel's code-signing trust cache — a legitimate OS mechanism — to inject malicious payloads and invoke privileged XPC methods. This is particularly dangerous because it requires no kernel exploit and generates no alerts, meaning defenders may be completely blind to the compromise. CrowdStrike and Kandji were both affected, highlighting that even leading security vendors can have exploitable weaknesses in their own agents. The core issue stems from over-reliance on OS-level trust mechanisms without secondary validation and insufficient hardening of privileged inter-process communication channels.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-39118