macOS Spotlight plugin bypasses TCC via notifications
A researcher demonstrates a 0-day where a malicious Spotlight plugin on macOS Tahoe can leak TCC-protected files by encoding bytes as Darwin notification names.
Objective-See researcher Patrick Wardle details a local privilege bypass in macOS's Spotlight indexing subsystem that still works on the newest macOS Tahoe (26) release. Spotlight plugins (mdimporters) are heavily sandboxed but are granted access to TCC-protected files in order to index their contents. Wardle shows that a malicious plugin can exfiltrate file bytes to an external, non-sandboxed listener process by encoding each byte value (0-255) as the name of a Darwin notification center notification—since notifications without payload data are not blocked by the sandbox. An external process can register for all 256 possible notification names and reconstruct the leaked file byte-by-byte, effectively bypassing TCC protections without requiring any special entitlements or root access.
The underlying notification-abuse technique was first disclosed by Wardle in 2018 ("Mojave's Sandbox is Leaky") and remains unpatched years later. The PoC targets knowledgeC.db, a system database that logs comprehensive user/system behavioral data (app usage, Safari history, interaction patterns) feeding Apple Intelligence features, though the technique could theoretically apply to any file Spotlight indexes. The exploit requires local code execution as a prerequisite and has limited bandwidth (one byte at a time), making it more a proof-of-concept highlighting a systemic sandbox weakness than a practical mass-exfiltration tool. The article also references two related, now-patched Spotlight/TCC bypass vulnerabilities (CVE-2024-54533 and CVE-2025-31199) discovered by other researchers, underscoring a recurring pattern of Spotlight plugin sandbox escapes being found and only partially remediated by Apple.
Mentioned in this report
Detection guidance
New Spotlight mdimporter Plugin Bundle Written to User-Writable Path
Detects .mdimporter plugin bundles being written outside the standard system Spotlight plugin directories (e.g. under /Users or /tmp), consistent with dropping a malicious mdimporter that Spotlight will auto-load during indexing to gain sandboxed-but-trusted access to TCC-protected files. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: New Spotlight mdimporter Plugin Bundle Written to User-Writable Path
description: Legitimate Spotlight importer plugins ship under /System/Library/Spotlight,
/Library/Spotlight, or inside signed application bundles (Contents/Library/Spotlight).
A .mdimporter bundle appearing under a user home directory or temp path is a strong
indicator of an attacker planting a malicious plugin that will be auto-loaded by
mdworker during indexing (Boot/Logon Autostart via Spotlight plugin), a known TCC-sandbox-abuse
vector.
tags:
- attack.persistence
- attack.t1547
logsource:
category: file_event
product: macos
detection:
selection:
TargetFilename|contains:
- /Users/
- /tmp/
- /private/tmp/
condition: selection
falsepositives:
- Plugin developers building/testing mdimporter bundles from a home directory during
development
- Third-party installers that stage plugin files in a user temp directory before moving
them to /Library/Spotlight
level: high
id: ab172f07-9b50-56e3-9642-66e3217d7be6
status: experimental
author: Vorant
Manual Spotlight Importer Registration via mdimport -r
Detects use of mdimport -r to force Spotlight to register/reload a specific importer plugin without a reboot or reindex, a technique that can be used to get a freshly-dropped malicious mdimporter loaded into the trusted mdworker process context. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Manual Spotlight Importer Registration via mdimport -r
description: mdimport -r forces macOS to (re)register a specific mdimporter bundle
immediately. Outside of developer/plugin-debugging workflows this is rarely invoked
and is a plausible step after dropping a malicious plugin, causing it to load and
execute inside the semi-trusted mdworker process boundary that has file-read access
used to reach TCC-protected data.
tags:
- attack.defense-evasion
- attack.t1055
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith: /mdimport
CommandLine|contains: '-r '
condition: selection
falsepositives:
- Developers testing their own Spotlight importer plugin via mdimport -r during build/debug
cycles
- Rare IT troubleshooting scripts that force-reindex a specific importer
level: medium
id: 89e87a5f-858b-5372-8b79-44039cfe44fa
status: experimental
author: Vorant
notifyutil Watching Large Numeric Darwin Notification Namespace
Detects notifyutil invoked to watch a large number of sequential/numeric Darwin notification names in a single command, consistent with an external listener reconstructing exfiltrated file bytes that a sandboxed plugin has encoded one byte per notification name (0-255). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: notifyutil Watching Large Numeric Darwin Notification Namespace
description: Darwin notifications carry no payload and are not gated by the sandbox,
so a malicious Spotlight plugin can leak file bytes by posting notifications whose
names encode byte values 0-255. Reconstructing the data requires an external process
to register observers for the full (or large portion of the) numeric notification
namespace. A single notifyutil invocation watching many distinct names at once is
unusual for normal system/debugging use and matches this covert-channel exfiltration
pattern.
tags:
- attack.collection
- attack.t1005
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith: /notifyutil
high_watch_count:
CommandLine|re: (-w\s+\S+\s*){15,}
condition: selection and high_watch_count
falsepositives:
- Low-level system debugging or QA tooling that legitimately monitors many Darwin
notification names at once
level: high
id: 590c0d2e-6ae1-5f18-8c04-a5aa54ea7624
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x81.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free