macOS Attack Technique Silently Disables EDR and MDM Tools Without Admin Privileges
Cybersecurity firm XM Cyber has uncovered a novel macOS attack method that allows a standard, non-administrative user to disable enterprise endpoint security tools including EDR and MDM agents without triggering alerts or requiring kernel exploits. The technique leverages legitimate macOS behaviors rather than software vulnerabilities, making detection difficult.
The attack exploits weakly validated XPC connections and the injection of malicious payloads into application Interface Builder (NIB) files, techniques previously documented but never chained in this way. A key component involves abusing the persistence of the kernel’s code-signing trust cache after a signed application executes, enabling attackers to impersonate trusted app components and invoke privileged XPC methods undetected.
XM Cyber demonstrated the technique against CrowdStrike Falcon Sensor, which was fully unloaded from a standard user account, and Kandji MDM, which was permanently deactivated via a two-stage exploit that cleared EDR protections and terminated the Endpoint Security Framework extension. A third, unnamed enterprise EDR vendor was also successfully targeted and is working on a patch.
Vendor Responses:
- CrowdStrike paid a bug bounty and implemented detection measures.
- Kandji patched the flaw and assigned CVE-2026-39118.
- Apple has not yet publicly commented.
Researcher Hillel Pinto will release an open-source tool, XPC Hunter, to automate the detection of exploitable XPC privilege escalation surfaces across macOS applications. A full presentation is scheduled for Black Hat US in August 2026. The findings highlight persistent risks in macOS security, even as Apple continues to address legacy attack vectors.
Source: https://www.securityweek.com/macos-weaknesses-chained-to-silently-disable-endpoint-security-agents/
CrowdStrike cybersecurity rating report: https://www.rankiteo.com/company/crowdstrike
Iru cybersecurity rating report: https://www.rankiteo.com/company/officiallyiru
"id": "CROOFF1782312102",
"linkid": "crowdstrike, officiallyiru",
"type": "Cyber Attack",
"date": "8/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Cybersecurity',
'name': 'CrowdStrike',
'type': 'Cybersecurity Vendor'},
{'industry': 'Cybersecurity / Device Management',
'name': 'Kandji',
'type': 'MDM Vendor'},
{'industry': 'Cybersecurity',
'name': 'Unnamed Enterprise EDR Vendor',
'type': 'Cybersecurity Vendor'}],
'attack_vector': 'XPC connections / NIB file injection / Code-signing trust '
'cache abuse',
'description': 'Cybersecurity firm XM Cyber has uncovered a novel macOS '
'attack method that allows a standard, non-administrative user '
'to disable enterprise endpoint security tools including EDR '
'and MDM agents without triggering alerts or requiring kernel '
'exploits. The technique leverages legitimate macOS behaviors '
'rather than software vulnerabilities, making detection '
'difficult. The attack exploits weakly validated XPC '
'connections and the injection of malicious payloads into '
'application Interface Builder (NIB) files. A key component '
'involves abusing the persistence of the kernel’s code-signing '
'trust cache after a signed application executes, enabling '
'attackers to impersonate trusted app components and invoke '
'privileged XPC methods undetected.',
'impact': {'operational_impact': 'Disabling of EDR and MDM protections, '
'potential unauthorized access or '
'persistence',
'systems_affected': 'macOS systems with EDR/MDM tools (CrowdStrike '
'Falcon Sensor, Kandji MDM, unnamed enterprise '
'EDR vendor)'},
'investigation_status': 'Ongoing (research presented at Black Hat US 2026)',
'lessons_learned': 'Persistent risks in macOS security due to legitimate '
'system behaviors, challenges in detecting '
'non-vulnerability-based attacks, importance of validating '
'XPC connections and monitoring code-signing trust cache '
'persistence.',
'post_incident_analysis': {'corrective_actions': 'Patches for CVE-2026-39118 '
'(Kandji), detection '
'measures (CrowdStrike), '
'open-source tool (XPC '
'Hunter) for detecting '
'exploitable XPC surfaces',
'root_causes': 'Weakly validated XPC connections, '
'NIB file injection, abuse of '
'kernel code-signing trust cache '
'persistence'},
'recommendations': 'Enterprises should monitor for unusual XPC activity, '
'validate all XPC connections, and apply patches from '
'EDR/MDM vendors. Use tools like XPC Hunter to detect '
'exploitable privilege escalation surfaces.',
'references': [{'source': 'XM Cyber Research'},
{'source': 'Black Hat US 2026 Presentation'}],
'response': {'remediation_measures': 'Patches issued by Kandji '
'(CVE-2026-39118), detection measures '
'implemented by CrowdStrike'},
'title': 'macOS Attack Technique Silently Disables EDR and MDM Tools Without '
'Admin Privileges',
'type': 'Privilege Escalation / EDR Bypass',
'vulnerability_exploited': 'Weakly validated XPC connections, Interface '
'Builder (NIB) file injection, kernel code-signing '
'trust cache persistence'}