macOS synthetic-click bypasses hit Apple UI security
Patrick Wardle details how synthetic mouse/keyboard events let malware bypass macOS security prompts, including a 0day allowing unprivileged kernel extension loading.
Sourceobjective-see.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
This research post from Objective-See's Patrick Wardle (mirroring his DefCon talk 'The Mouse is Mightier than the Sword') examines how macOS malware and attackers can programmatically generate 'synthetic' mouse and keyboard events to bypass user-facing security prompts. Historical malware examples include OSX.FruitFly, which remotely dismissed keychain access prompts, OSX.DevilRobber, which used AppleScript to dump keychains, and the adware OSX.Genieo, which synthetically clicked 'Allow' to install malicious browser extensions. Apple introduced protections in recent macOS versions (TCC/sandbox checks via CGXSenderCanSynthesizeEvents and hid-control entitlement checks) to block synthetic events targeting protected UI components.
Wardle demonstrates that these protections are incomplete. By enabling the accessibility feature 'Mouse Keys' programmatically via AppleScript and then sending a synthetic keypress that the OS converts into a trusted mouse click, an attacker can bypass keychain access prompts entirely — a bug reported to Apple and patched as CVE-2017-7150. Despite this patch, further issues remain unpatched even on fully updated High Sierra: privacy alerts (geolocation, contacts, calendar) still accept synthetic mouse events and can be silently dismissed, and a separate bug allows two consecutive synthetic 'mouse down' events to be converted by the OS into a mouse down/up pair with a PID of 0 (trusted system source), which can be used to approve the 'User Assisted Kernel Loading' prompt without any user interaction or root privileges beyond the initial exploit — effectively defeating Apple's kext-loading security control.
Wardle also notes attackers can conceal these synthetic interactions by dimming the screen to 0% brightness (while keeping the UI active), making the exploited clicks invisible to the user. He states Apple was aware of the attack vector but had not fully addressed it; as a fix, macOS Mojave (10.14) globally blocks synthetic events by default unless an app is explicitly granted permission, closing this bypass class going forward.
Mentioned in this report
Detection guidance
AppleScript Enabling Mouse Keys Accessibility Feature
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
AppleScript or osascript process programmatically enabling Mouse Keys accessibility feature - often precursor to synthetic event injection bypass attacks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: AppleScript Enabling Mouse Keys Accessibility Feature
description: Detects AppleScript or osascript enabling the Mouse Keys accessibility
feature via System Events, a common precursor to synthetic UI event bypass attacks
on macOS.
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith:
- /osascript
- /AppleScript
CommandLine|contains:
- System Events
- make new
- set enabled
condition: selection
falsepositives:
- Accessibility configuration tools enabling Mouse Keys for legitimate users
- IT deployment scripts configuring accessibility settings
level: medium
id: 509fc108-e5c6-5dca-9ac2-9d7915d8ca19
status: experimental
author: Vorant
Screen Brightness Manipulation to Conceal Synthetic UI Interactions
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Process dimming display brightness to 0% while keeping UI active - used to hide synthetic click operations from user observation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Screen Brightness Manipulation to Conceal Synthetic UI Interactions
description: Detects processes setting display brightness to zero while the system
remains interactive, often used to hide synthetic UI event injection from users.
tags:
- attack.stealth
- attack.t1684.001
logsource:
category: process_creation
product: macos
detection:
selection:
CommandLine|contains:
- System Events
- set brightness
Image|endswith:
- /osascript
- /brightness
filter_legitimate:
Image|endswith:
- /SystemUIServer
- /loginwindow
condition: selection and not filter_legitimate
falsepositives:
- Power management tools reducing brightness automatically
- Screen lock or sleep transition logic
level: medium
id: 1ac617bd-04e0-52a1-bea0-d638203a77fd
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x36.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,572 reports from 147 sources, 724 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs