Researcher revives macOS reflective code loading

A security researcher demonstrated a technique compiling Apple's own dyld loader code to restore in-memory reflective code loading on macOS 15, after Apple's APIs began forcing payloads to disk.

This Objective-See research post, based on an OBTS v7.0 talk, examines reflective code loading (MITRE ATT&CK T1620) on macOS — a technique historically used by malware to execute compiled binaries directly from memory, avoiding disk-based detection. The author traces the technique's history from Apple's 2005 MemoryBasedBundle sample project through its use in real-world malware including Lazarus Group's AppleJeus (which copied open-source osx_runbin code from a 2017 Cylance post), EvilQuest, and the Windows-based Gauss malware with its still-unbroken environmentally-encrypted payloads.

The post explains that Apple silently modified dyld3's NSLinkModule API so that in-memory payloads are now always written to a predictable temp-file path before execution, effectively neutering the classic reflective loading APIs that malware authors had relied upon for nearly two decades — a change many malware developers appear not to have noticed. The researcher then demonstrates a novel bypass: extracting and compiling the core loader logic directly from Apple's open-source dyld into a custom function (custom_dlopen_from_memory), fully restoring true memory-only execution on macOS 15 without generating file-system artifacts. The author also covers hardened runtime and code-signing obstacles and how specific entitlements can be used to preserve unsigned in-memory execution while still allowing notarization.

An open-source proof-of-concept (ReflectiveLoader) was released on GitHub, providing a working custom loader library and example payload. The article is intended as offensive/defensive security research; the author notes a follow-up post will address detection strategies for this stealthy capability, which currently has few effective countermeasures given macOS's restrictions on remote memory scanning.

Source reporting: https://objective-see.org/blog/blog_0x7C.html