How attackers adapt to built-in macOS protection

macOS hosts a suite of built-in protections, from Keychain’s secure storage of secrets to Gatekeeper’s checks on application signatures and quarantined files. Keychain, introduced long before 2010, stores passwords and credentials and protects them with AES-256-GCM, though attackers can still exploit it with utilities like Chainbreaker if they gain access to the file and its password.

System Integrity Protection (SIP) safeguards critical directories, first appearing in OS X 10.11 El Capitan, and can only be disabled by rebooting into Recovery Mode and running csrutil, a status often sought by attackers. The TCC framework governs user consent for sensitive data access and can be bypassed by techniques such as TCC clickjacking, while attackers aim to obtain Full Disk Access or Accessibility rights.

File Quarantine marks downloaded files with a quarantine attribute to warn users, with methods like curl or wget used to bypass it, and can be defeated by removing the attribute with xattr -d com.apple.quarantine. Gatekeeper uses the spctl utility to verify signatures and can be defeated by disabling Gatekeeper with spctl –master disable or --global-disable, often via social engineering.

According to Kaspersky, these mechanisms remain highly resilient but are continually targeted, and detecting bypass attempts relies on monitoring specific commands and Burke-style detection rules.