macOS synthetic-click bypasses hit Apple UI security
Patrick Wardle details how synthetic mouse/keyboard events let malware bypass macOS security prompts, including a 0day allowing unprivileged kernel extension loading.
This research post from Objective-See's Patrick Wardle (mirroring his DefCon talk 'The Mouse is Mightier than the Sword') examines how macOS malware and attackers can programmatically generate 'synthetic' mouse and keyboard events to bypass user-facing security prompts. Historical malware examples include OSX.FruitFly, which remotely dismissed keychain access prompts, OSX.DevilRobber, which used AppleScript to dump keychains, and the adware OSX.Genieo, which synthetically clicked 'Allow' to install malicious browser extensions. Apple introduced protections in recent macOS versions (TCC/sandbox checks via CGXSenderCanSynthesizeEvents and hid-control entitlement checks) to block synthetic events targeting protected UI components.
Wardle demonstrates that these protections are incomplete. By enabling the accessibility feature 'Mouse Keys' programmatically via AppleScript and then sending a synthetic keypress that the OS converts into a trusted mouse click, an attacker can bypass keychain access prompts entirely — a bug reported to Apple and patched as CVE-2017-7150. Despite this patch, further issues remain unpatched even on fully updated High Sierra: privacy alerts (geolocation, contacts, calendar) still accept synthetic mouse events and can be silently dismissed, and a separate bug allows two consecutive synthetic 'mouse down' events to be converted by the OS into a mouse down/up pair with a PID of 0 (trusted system source), which can be used to approve the 'User Assisted Kernel Loading' prompt without any user interaction or root privileges beyond the initial exploit — effectively defeating Apple's kext-loading security control.
Wardle also notes attackers can conceal these synthetic interactions by dimming the screen to 0% brightness (while keeping the UI active), making the exploited clicks invisible to the user. He states Apple was aware of the attack vector but had not fully addressed it; as a fix, macOS Mojave (10.14) globally blocks synthetic events by default unless an app is explicitly granted permission, closing this bypass class going forward.
Mentioned in this report
Detection guidance
AppleScript Enabling Mouse Keys Accessibility Feature
AppleScript or osascript process programmatically enabling Mouse Keys accessibility feature - often precursor to synthetic event injection bypass attacks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: AppleScript Enabling Mouse Keys Accessibility Feature
description: Detects AppleScript or osascript enabling the Mouse Keys accessibility
feature via System Events, a common precursor to synthetic UI event bypass attacks
on macOS.
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith:
- /osascript
- /AppleScript
CommandLine|contains:
- System Events
- make new
- set enabled
condition: selection
falsepositives:
- Accessibility configuration tools enabling Mouse Keys for legitimate users
- IT deployment scripts configuring accessibility settings
level: medium
id: 509fc108-e5c6-5dca-9ac2-9d7915d8ca19
status: experimental
author: Vorant
Synthetic Mouse Event Generation via Accessibility APIs
Process using CGEvent or IOHIDEventSystemClient APIs to programmatically generate synthetic mouse/keyboard events - characteristic of UI security bypass attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Synthetic Mouse Event Generation via Accessibility APIs
description: Detects processes calling accessibility or HID APIs to synthesize mouse
or keyboard events, bypassing macOS UI security controls and user interaction requirements.
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
category: image_load
product: macos
detection:
selection:
ImageLoaded|contains:
- /CoreGraphics.framework
- /IOKit.framework
ProcessName|endswith:
- osascript
- python
- ruby
- perl
- bash
CommandLine|contains:
- CGEventCreate
- IOHIDEventSystemClient
- kCGMouseButtonLeft
- kCGEventMouseMoved
condition: selection
falsepositives:
- Legitimate accessibility applications for users with motor impairments
- Screen reader or magnification software
level: high
id: ac935f0e-0471-55e2-85bf-26b0c48993c7
status: experimental
author: Vorant
Screen Brightness Manipulation to Conceal Synthetic UI Interactions
Process dimming display brightness to 0% while keeping UI active - used to hide synthetic click operations from user observation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Screen Brightness Manipulation to Conceal Synthetic UI Interactions
description: Detects processes setting display brightness to zero while the system
remains interactive, often used to hide synthetic UI event injection from users.
tags:
- attack.defense-evasion
- attack.t1656
logsource:
category: process_creation
product: macos
detection:
selection:
CommandLine|contains:
- System Events
- set brightness
Image|endswith:
- /osascript
- /brightness
filter_legitimate:
Image|endswith:
- /SystemUIServer
- /loginwindow
condition: selection and not filter_legitimate
falsepositives:
- Power management tools reducing brightness automatically
- Screen lock or sleep transition logic
level: medium
id: 1ac617bd-04e0-52a1-bea0-d638203a77fd
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x36.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free