Researcher revives macOS reflective code loading
A security researcher demonstrated a technique compiling Apple's own dyld loader code to restore in-memory reflective code loading on macOS 15, after Apple's APIs began forcing payloads to disk.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
This Objective-See research post, based on an OBTS v7.0 talk, examines reflective code loading (MITRE ATT&CK T1620) on macOS — a technique historically used by malware to execute compiled binaries directly from memory, avoiding disk-based detection. The author traces the technique's history from Apple's 2005 MemoryBasedBundle sample project through its use in real-world malware including Lazarus Group's AppleJeus (which copied open-source osx_runbin code from a 2017 Cylance post), EvilQuest, and the Windows-based Gauss malware with its still-unbroken environmentally-encrypted payloads.
The post explains that Apple silently modified dyld3's NSLinkModule API so that in-memory payloads are now always written to a predictable temp-file path before execution, effectively neutering the classic reflective loading APIs that malware authors had relied upon for nearly two decades — a change many malware developers appear not to have noticed. The researcher then demonstrates a novel bypass: extracting and compiling the core loader logic directly from Apple's open-source dyld into a custom function (custom_dlopen_from_memory), fully restoring true memory-only execution on macOS 15 without generating file-system artifacts. The author also covers hardened runtime and code-signing obstacles and how specific entitlements can be used to preserve unsigned in-memory execution while still allowing notarization.
An open-source proof-of-concept (ReflectiveLoader) was released on GitHub, providing a working custom loader library and example payload. The article is intended as offensive/defensive security research; the author notes a follow-up post will address detection strategies for this stealthy capability, which currently has few effective countermeasures given macOS's restrictions on remote memory scanning.
Mentioned in this report
Source reporting: https://objective-see.org/blog/blog_0x7C.html
Free public brief. The indicators are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,566 reports from 147 sources, 722 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs