# macOS synthetic-click bypasses hit Apple UI security

Published: 2026-08-02 · Severity: medium
Canonical: https://vorant.io/reports/7a21054c-8d49-5cc4-91dd-ab27c0fcc70e/macos-synthetic-click-bypasses-hit-apple-ui-security

> Patrick Wardle details how synthetic mouse/keyboard events let malware bypass macOS security prompts, including a 0day allowing unprivileged kernel extension loading.

This research post from Objective-See's Patrick Wardle (mirroring his DefCon talk 'The Mouse is Mightier than the Sword') examines how macOS malware and attackers can programmatically generate 'synthetic' mouse and keyboard events to bypass user-facing security prompts. Historical malware examples include OSX.FruitFly, which remotely dismissed keychain access prompts, OSX.DevilRobber, which used AppleScript to dump keychains, and the adware OSX.Genieo, which synthetically clicked 'Allow' to install malicious browser extensions. Apple introduced protections in recent macOS versions (TCC/sandbox checks via CGXSenderCanSynthesizeEvents and hid-control entitlement checks) to block synthetic events targeting protected UI components.

Wardle demonstrates that these protections are incomplete. By enabling the accessibility feature 'Mouse Keys' programmatically via AppleScript and then sending a synthetic keypress that the OS converts into a trusted mouse click, an attacker can bypass keychain access prompts entirely — a bug reported to Apple and patched as CVE-2017-7150. Despite this patch, further issues remain unpatched even on fully updated High Sierra: privacy alerts (geolocation, contacts, calendar) still accept synthetic mouse events and can be silently dismissed, and a separate bug allows two consecutive synthetic 'mouse down' events to be converted by the OS into a mouse down/up pair with a PID of 0 (trusted system source), which can be used to approve the 'User Assisted Kernel Loading' prompt without any user interaction or root privileges beyond the initial exploit — effectively defeating Apple's kext-loading security control.

Wardle also notes attackers can conceal these synthetic interactions by dimming the screen to 0% brightness (while keeping the UI active), making the exploited clicks invisible to the user. He states Apple was aware of the attack vector but had not fully addressed it; as a fix, macOS Mojave (10.14) globally blocks synthetic events by default unless an app is explicitly granted permission, closing this bypass class going forward.

## Mentioned in this report

- Vulnerabilities: CVE-2017-7150
- Malware: OSX.DevilRobber, OSX.FruitFly, OSX.Genieo

Source reporting: https://objective-see.org/blog/blog_0x36.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/7a21054c-8d49-5cc4-91dd-ab27c0fcc70e/macos-synthetic-click-bypasses-hit-apple-ui-security.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup