# macOS Vulnerability Allows Attackers to Replace Any App With Malicious Code

**URL:** https://discuss.privacyguides.net/t/macos-vulnerability-allows-attackers-to-replace-any-app-with-malicious-code/39320
**Category:** News
**Created:** 2026-07-24T00:18:57Z
**Posts:** 3

## Post 1 by @fria — 2026-07-24T00:18:58Z

Researchers [Talal Haj Bakry](https://x.com/hajbakri) and [Tommy Mysk](https://x.com/tommymysk) [discovered](https://mysk.blog/2026/07/23/macos-overwrite-app-executables/) a vulnerability in macOS that allows an attacker to replace already installed apps with malicious versions that look indistinguishable from the real app.

* * *
This is a companion discussion topic for the original entry at [https://www.privacyguides.org/news/2026/07/24/macos-vulnerability-allows-attackers-to-replace-any-app-with-malicious-code/](https://www.privacyguides.org/news/2026/07/24/macos-vulnerability-allows-attackers-to-replace-any-app-with-malicious-code/)

---

## Post 2 by @hbxc0re — 2026-07-24T00:26:10Z

A huge reason why I always implement Santa on all new installs of MacOS. [https://santa.dev/](https://santa.dev/)  
[Binary Authorization | Santa](https://northpole.dev/features/binary-authorization/)

---

## Post 3 by @Sorge — 2026-07-24T12:25:36Z

It can be discussed, but generally, if attacker can launch random code as the legit user — the game is already lost.

> Apple concluded that the reported behaviour does not constitute a security issue for the following reasons:
> 
> - The proof of concept replaces the entire application bundle rather than modifying an existing signed executable.
> - The attack requires code execution as the current user and only affects applications owned by that user.
> - The replacement executable does not inherit the original application’s entitlements or previously granted TCC permissions, requiring the user to approve new authorization prompts.
> - Apple considers convincing a user to approve these prompts to be a matter of social engineering rather than a bypass of TCC or other security mechanisms.
> - Gatekeeper is designed to evaluate downloaded applications before their first launch and is not intended to protect files already owned and modified by the current user.