Researcher shows AV signatures could exfiltrate secrets

2 August 2026 elevated vulnerability technologygovernment-national

A researcher reverse-engineered Kaspersky's macOS AV engine and demonstrated how its signature system could be subverted to detect and flag classified documents.

This research post explores whether an anti-virus engine could be covertly repurposed as an espionage collection tool, using Kaspersky Internet Security for macOS as a case study. The researcher reverse-engineered the kav daemon, identifying how encrypted signature updates are downloaded, decrypted, and dynamically linked into the running process as executable detection routines rather than simple static patterns. By locating an in-memory signature originally designed to detect a CVE-2010-3333 RTF exploit, the researcher was able to subvert it—first via a debugger and then via a remote process memory write using mach_vm_write()—to instead match classification markers such as 'TS/SCI' within documents, causing Kaspersky to flag and quarantine non-malicious files (e.g., a test copy of Winnie the Pooh) containing those markers.

The post further demonstrates patching the executable code of the signature detection routine itself (still without touching the core AV engine binary) to remove file-size and format constraints, broadening detection to any document containing classification markers. The author stops short of testing exfiltration/upload behavior, noting Kaspersky's cloud submission features (KSN) could plausibly upload flagged files, but disabled network access during testing to avoid triggering real uploads.

This is a technical research demonstration referencing prior allegations (unproven, and explicitly not endorsed by the author) that Kaspersky software was involved in exfiltration of classified NSA materials. The piece is intended to illustrate a conceptual security/trust risk inherent to any AV product's signature update mechanism—namely that a malicious insider or coerced vendor could weaponize legitimate scanning/collection infrastructure—rather than to report on any actual observed malicious campaign or exploited vulnerability in the wild.

Mentioned in this report

Vulnerabilities CVE-2010-3333KEV

Detection guidance

Process Memory Write to AV Daemon via Mach VM API

ATT&CK T1055

Detects suspicious use of mach_vm_write() or similar process memory injection APIs targeting AV/security daemon processes—indicative of in-memory signature/detection routine modification. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Process Memory Write to AV Daemon via Mach VM API
description: Detects calls to mach_vm_write() or similar Mach kernel APIs targeting
  antivirus/security daemon processes on macOS. This behavioural pattern is consistent
  with in-memory patching of AV detection routines.
tags:
- attack.defense-evasion
- attack.t1055
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|contains:
    - mach_vm_write
    - vm_write
    TargetParentImage|endswith:
    - /kaspersky
    - /kav
    - /avast
    - /mcafee
    - /sophos
    - /bitdefender
    - /norton
  condition: selection
falsepositives:
- Debugging or instrumentation tools legitimately patching AV processes during authorized
  security research
- Some AV products performing legitimate inter-process communication with helper daemons
level: high
id: 4f565ba5-a504-5a1a-a04c-91cee52870ec
status: experimental
author: Vorant

AV Daemon Downloading and Decrypting Signature Updates

ATT&CK T1005

Detects AV daemon processes initiating HTTPS/encrypted connections to signature update servers followed by in-process decryption operations—behavioural precursor to signature modification. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: AV Daemon Downloading and Decrypting Signature Updates
description: Detects antivirus daemon processes establishing network connections to
  signature/update servers and performing decryption (crypto library calls) in the
  same process lifetime. This pattern precedes dynamic signature manipulation.
tags:
- attack.collection
- attack.t1005
logsource:
  category: network_connection
  product: macos
detection:
  selection_av_daemon:
    Image|endswith:
    - /kav
    - /kaspersky
    - /avast
    - /mcafee
    - /sophos
    - /bitdefender
    DestinationPort: 443
    Protocol: tcp
  selection_update_server:
    DestinationHostname|contains:
    - kaspersky
    - avast
    - mcafee
    - sophos
    - bitdefender
    - norton
  filter_legitimate:
    CommandLine|contains:
    - --update
    - --signature-update
  condition: (selection_av_daemon and selection_update_server) and not filter_legitimate
falsepositives:
- Normal scheduled signature update operations on systems with legitimate AV deployed
- Routine TLS traffic from AV daemons to CDNs or cloud services
level: low
id: 75ff8aff-fad0-559c-8081-df2f628ac5f0
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x22.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free