Rootkit on macOS Systems | Microsoft
Microsoft finds new macOS vulnerability, Shrootless, that could bypass System Integrity Protection
Microsoft on Thursday disclosed details of a new vulnerability that could allow an attacker to bypass security restrictions in macOS and take complete control of the device to perform arbitrary operations on the device without getting flagged by traditional security solutions.
Dubbed "Shrootless" and tracked as CVE-2021-30892, the "vulnerability lies in how Apple-signed packages with post-install scripts are installed," Microsoft 365 Defender Research Team's Jonathan Bar Or said in a technical write-up. "A malicious actor could create a specially crafted file that would hijack the installation process."