[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHdRJ3Cr-_7GAEv9ygka72K_qdxBE5dU0LeRN0_sDj9c":3},{"article":4,"iocs":54,"watch_terms":59,"solutions":60,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"0f6e9292-301b-4682-a6a0-641a1ca7ca38","macOS Weaknesses Chained to Silently Disable Endpoint Security Agents","macos-weaknesses-chained-to-silently-disable-endpoint-security-agents-53a492","A standard non-admin account is sufficient to conduct an attack that exploits legitimate OS behavior rather than software vulnerabilities. The post macOS Weaknesses Chained to Silently Disable Endpoint Security Agents appeared first on SecurityWeek.","XM Cyber has demonstrated a novel attack chain on macOS that enables a standard, non-administrative user to silently disable endpoint security tools like EDR and MDM agents. This technique abuses legitimate macOS behavior, specifically the persistence of the kernel's code-signing trust cache, to inject malicious payloads and invoke privileged XPC methods without triggering alerts or requiring kernel exploits. The attack successfully targeted CrowdStrike Falcon Sensor and Kandji MDM, with CrowdStrike issuing a bug bounty and Kandji releasing a patch.","macOS attack chain allows non-admin users to disable endpoint security agents.","https:\u002F\u002Fwww.securityweek.com\u002Fmacos-weaknesses-chained-to-silently-disable-endpoint-security-agents\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F02\u002FMacOS-Mac-malware-Apple.jpeg","2026-06-24T13:50:53+00:00","2026-06-24T14:00:24.137638+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"macOS","product",{"name":21,"type":22},"XM Cyber","vendor",{"name":24,"type":19},"CrowdStrike Falcon Sensor",{"name":26,"type":22},"CrowdStrike",{"name":28,"type":19},"Kandji MDM",{"name":30,"type":22},"Kandji","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":56,"value":57,"context":58},"cve","CVE-2026-39118","Assigned to the Kandji MDM flaw exploited by XM Cyber.",[26,21,30],{"controls":61,"vendors":137},[62,91,112],{"slug":63,"name":64,"problem":65,"products":66},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"slug":92,"name":93,"problem":94,"products":95},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[96,104],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":113,"name":114,"problem":115,"products":116},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[117,122,129],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":118,"product_name":119,"url":120,"description":121},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":123,"vendor_name":26,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"crowdstrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[138],{"slug":123,"name":26,"logo_path":124,"roles":139},[140],"affected",{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":157},"macos-attack-chain-silently-disables-edr-and-mdm-agents","macOS Attack Chain Silently Disables EDR and MDM Agents","XM Cyber revealed a novel macOS attack chain that allows a non-administrative user to silently disable endpoint security tools by abusing the kernel's code-signing trust cache — a legitimate OS mechanism — to inject malicious payloads and invoke privileged XPC methods. This is particularly dangerous because it requires no kernel exploit and generates no alerts, meaning defenders may be completely blind to the compromise. CrowdStrike and Kandji were both affected, highlighting that even leading security vendors can have exploitable weaknesses in their own agents. The core issue stems from over-reliance on OS-level trust mechanisms without secondary validation and insufficient hardening of privileged inter-process communication channels.",[146,147,148,149,150,151,152,153,154,155,156],"CIS Control 7: Continuous Vulnerability Management","CIS Control 10: Malware Defenses","CIS Control 18: Penetration Testing","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 AU-6: Audit Record Review","NIST CSF DE.CM-4: Malicious Code Detection","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","CIS macOS Benchmark v3.0","MITRE ATT&CK T1562.001: Impair Defenses – Disable or Modify Tools",{}]