macOS Finder Sync abused for persistence
Researchers show macOS malware can abuse Finder Sync extensions and pluginkit to achieve stealthy, automatic persistence at login.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
This Objective-See research post explores how macOS's Finder Sync extension mechanism, intended to let apps like Google Drive or Dropbox integrate with Finder.app, can be abused by malware for persistence. Because Finder Sync bundles are automatically registered and loaded by the pkd (PluginKit daemon) launch agent, and because a constructor function can be embedded to execute code as soon as the bundle loads, an attacker can install a malicious Finder Sync via the pluginkit command-line utility without needing a wrapper application or external plist. This gives malware a way to be reliably re-executed every time the system starts and the user logs in.
The author notes that while Finder Syncs must be sandboxed and code-signed to be accepted by the OS, this is not necessarily a strong barrier — pointing to real macOS malware families such as Janicab and Piritt that carried valid Apple developer ID signatures. A malicious extension could also request broad file-system access via temporary-exception entitlements, and could disguise itself with an innocuous name (e.g., mimicking Dropbox or Google Drive) since the System Preferences UI does not show path or signing details.
To address detection gaps, the author updated their KnockKnock tool to enumerate and display all installed and activated extensions, including Finder Syncs, along with path, packing status, and VirusTotal detection ratio, enabling analysts to spot suspicious plugins. The piece is a defensive research/technique disclosure rather than a report of an active, in-the-wild campaign.
Mentioned in this report
Source reporting: https://objective-see.org/blog/blog_0x11.html
Free public brief. The indicators are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs