Researcher chains macOS App Store flaws to root

2 August 2026 routine vulnerability technology

A researcher detailed dylib hijacking in multiple macOS apps and an App Store installd bypass that let non-root users escalate to root, fixed by Apple in Mojave 10.14.5.

This is a technical research writeup rather than an active threat report. The author explores dylib hijacking vulnerabilities across numerous macOS applications (using Tresorit as a disclosed example), where weak or rpath-based dylib loading allows an attacker to plant malicious libraries that get loaded by legitimate signed applications, enabling code execution and persistence under the logged-in user's privileges.

The more significant finding is a privilege escalation chain abusing the macOS App Store installation daemon (installd), which runs as root. By creating symlinks in place of expected application folders (e.g., pointing to /usr/lib/cron/tabs, /Library/LaunchDaemons, /Library/StartupItems, or /etc) before triggering a reinstall via the App Store, an unprivileged admin user could redirect root-owned file writes to attacker-controlled locations, achieving root code execution via crontab entries, LaunchDaemons, or login hooks. The researcher built and published a legitimate-looking app ('Crontab Creator') to the App Store to prove the exploit path, successfully passing Apple's review process.

Apple partially fixed the crontab-folder redirection in Mojave 10.14.5 but the researcher found the broader symlink-redirection technique still worked against other protected directories, reporting a follow-up POC ('StartUp') targeting LaunchDaemons for root shell access via a bind shell. Apple did not assign a CVE, treating the issue as an enhancement rather than a security vulnerability, though they eventually fixed the underlying installd behavior in a later Mojave update and credited the researcher. No in-the-wild exploitation is reported; this is disclosed research with vendor acknowledgment.

Detection guidance

Suspicious Dylib Load from Writable Location by Signed Application

ATT&CK T1574.001

Detects signed macOS applications loading dylibs from world-writable or user-controlled directories (e.g., /tmp, /var/tmp, user home directories) via rpath or LC_LOAD_DYLIB, indicating dylib hijacking. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Dylib Load from Writable Location by Signed Application
description: Detects signed macOS applications attempting to load dynamic libraries
  from world-writable or user home directories. Dylib hijacking exploits weak rpath
  settings or missing library validation to inject malicious code into legitimate
  signed processes.
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1574.001
logsource:
  category: image_load
  product: macos
detection:
  selection:
    Image|endswith: .dylib
    ImageLoaded|contains:
    - /tmp/
    - /var/tmp/
    - /var/folders/
    - /Users/
  filter_legitimate_dev:
    ImageLoaded|contains:
    - .app/Contents/
    - /opt/homebrew/
  condition: selection and not filter_legitimate_dev
falsepositives:
- Development tools and IDEs loading plugins from user directories
- Package managers installing dylibs to user-writable staging directories
level: high
id: 49b37a26-d2cc-5325-a832-8ad98caec6a5
status: experimental
author: Vorant

Symlink Redirect to System-Protected Directory Before App Store Reinstall

ATT&CK T1548

Detects creation of symlinks pointing to protected system directories (cron tabs, LaunchDaemons, StartupItems, /etc) followed by App Store application reinstallation, enabling root privilege escalation via installd. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Symlink Redirect to System-Protected Directory Before App Store Reinstall
description: Detects symlink creation redirecting application bundle paths to protected
  system directories (e.g., /usr/lib/cron/tabs, /Library/LaunchDaemons, /Library/StartupItems,
  /etc) followed by App Store app reinstall. Exploits installd running as root to
  write attacker-controlled content to privileged locations.
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
  category: file_event
  product: macos
detection:
  selection_symlink:
    EventType: CreateSymbolicLink
    TargetFilename|contains:
    - /Applications/
    SymlinkTarget|contains:
    - /usr/lib/cron/tabs
    - /Library/LaunchDaemons
    - /Library/StartupItems
    - /etc/
  condition: selection_symlink
falsepositives:
- System administrators manually testing cron or LaunchDaemon symlink configurations
level: high
id: 81db9f10-eef8-5439-8a7c-3caaf279a4bc
status: experimental
author: Vorant

Crontab or LaunchDaemon Created via Root Process in App Bundle Directory

ATT&CK T1053.003

Detects creation of cron jobs or LaunchDaemon plist files by root-privileged processes (e.g., installd) within application bundle directories or mount points, indicative of privilege escalation via symlink redirection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Crontab or LaunchDaemon Created via Root Process in App Bundle Directory
description: Detects root-owned processes (installd, installer) creating crontab entries
  in /usr/lib/cron/tabs or LaunchDaemon plists in /Library/LaunchDaemons with paths
  traversing through app bundle directories or mount points. Indicates symlink-based
  privilege escalation chain.
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1053.003
logsource:
  category: file_event
  product: macos
detection:
  selection_cron:
    EventType: CreateKey
    TargetFilename|contains:
    - /usr/lib/cron/tabs/
    Image|contains:
    - installd
    - installer
  selection_launchdaemon:
    EventType: CreateKey
    TargetFilename|contains:
    - /Library/LaunchDaemons/
    Image|contains:
    - installd
    - installer
  condition: selection_cron or selection_launchdaemon
falsepositives:
- Legitimate App Store app updates or installations writing to system daemon directories
  during normal operation
level: high
id: ef50b132-48e7-58fd-aca9-d511621a65f7
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x46.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free