VORANT. Threat Intelligence Sign in Get the full feed

macOS synthetic-click bypasses hit Apple UI security

elevated threat

Patrick Wardle details how synthetic mouse/keyboard events let malware bypass macOS security prompts, including a 0day allowing unprivileged kernel extension loading.

This research post from Objective-See's Patrick Wardle (mirroring his DefCon talk 'The Mouse is Mightier than the Sword') examines how macOS malware and attackers can programmatically generate 'synthetic' mouse and keyboard events to bypass user-facing security prompts. Historical malware examples include OSX.FruitFly, which remotely dismissed keychain access prompts, OSX.DevilRobber, which used AppleScript to dump keychains, and the adware OSX.Genieo, which synthetically clicked 'Allow' to install malicious browser extensions. Apple introduced protections in recent macOS versions (TCC/sandbox checks via CGXSenderCanSynthesizeEvents and hid-control entitlement checks) to block synthetic events targeting protected UI components.

Wardle demonstrates that these protections are incomplete. By enabling the accessibility feature 'Mouse Keys' programmatically via AppleScript and then sending a synthetic keypress that the OS converts into a trusted mouse click, an attacker can bypass keychain access prompts entirely — a bug reported to Apple and patched as CVE-2017-7150. Despite this patch, further issues remain unpatched even on fully updated High Sierra: privacy alerts (geolocation, contacts, calendar) still accept synthetic mouse events and can be silently dismissed, and a separate bug allows two consecutive synthetic 'mouse down' events to be converted by the OS into a mouse down/up pair with a PID of 0 (trusted system source), which can be used to approve the 'User Assisted Kernel Loading' prompt without any user interaction or root privileges beyond the initial exploit — effectively defeating Apple's kext-loading security control.

Wardle also notes attackers can conceal these synthetic interactions by dimming the screen to 0% brightness (while keeping the UI active), making the exploited clicks invisible to the user. He states Apple was aware of the attack vector but had not fully addressed it; as a fix, macOS Mojave (10.14) globally blocks synthetic events by default unless an app is explicitly granted permission, closing this bypass class going forward.

Mentioned in this report

Vulnerabilities CVE-2017-7150
Malware OSX.DevilRobberOSX.FruitFlyOSX.Genieo

Detection guidance

AppleScript Enabling Mouse Keys Accessibility Feature

ATT&CK T1548

AppleScript or osascript process programmatically enabling Mouse Keys accessibility feature - often precursor to synthetic event injection bypass attacks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: AppleScript Enabling Mouse Keys Accessibility Feature
description: Detects AppleScript or osascript enabling the Mouse Keys accessibility
  feature via System Events, a common precursor to synthetic UI event bypass attacks
  on macOS.
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith:
    - /osascript
    - /AppleScript
    CommandLine|contains:
    - System Events
    - make new
    - set enabled
  condition: selection
falsepositives:
- Accessibility configuration tools enabling Mouse Keys for legitimate users
- IT deployment scripts configuring accessibility settings
level: medium
id: 509fc108-e5c6-5dca-9ac2-9d7915d8ca19
status: experimental
author: Vorant

Synthetic Mouse Event Generation via Accessibility APIs

ATT&CK T1548

Process using CGEvent or IOHIDEventSystemClient APIs to programmatically generate synthetic mouse/keyboard events - characteristic of UI security bypass attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Synthetic Mouse Event Generation via Accessibility APIs
description: Detects processes calling accessibility or HID APIs to synthesize mouse
  or keyboard events, bypassing macOS UI security controls and user interaction requirements.
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
  category: image_load
  product: macos
detection:
  selection:
    ImageLoaded|contains:
    - /CoreGraphics.framework
    - /IOKit.framework
    ProcessName|endswith:
    - osascript
    - python
    - ruby
    - perl
    - bash
    CommandLine|contains:
    - CGEventCreate
    - IOHIDEventSystemClient
    - kCGMouseButtonLeft
    - kCGEventMouseMoved
  condition: selection
falsepositives:
- Legitimate accessibility applications for users with motor impairments
- Screen reader or magnification software
level: high
id: ac935f0e-0471-55e2-85bf-26b0c48993c7
status: experimental
author: Vorant

Screen Brightness Manipulation to Conceal Synthetic UI Interactions

ATT&CK T1656

Process dimming display brightness to 0% while keeping UI active - used to hide synthetic click operations from user observation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Screen Brightness Manipulation to Conceal Synthetic UI Interactions
description: Detects processes setting display brightness to zero while the system
  remains interactive, often used to hide synthetic UI event injection from users.
tags:
- attack.defense-evasion
- attack.t1656
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    CommandLine|contains:
    - System Events
    - set brightness
    Image|endswith:
    - /osascript
    - /brightness
  filter_legitimate:
    Image|endswith:
    - /SystemUIServer
    - /loginwindow
  condition: selection and not filter_legitimate
falsepositives:
- Power management tools reducing brightness automatically
- Screen lock or sleep transition logic
level: medium
id: 1ac617bd-04e0-52a1-bea0-d638203a77fd
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x36.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free