How multiple vulnerabilities in Microsoft apps for macOS pave the way to stealing permissions
Summary: Cisco Talos found eight vulnerabilities in Microsoft's macOS applications that let an attacker bypass Apple's Transparency, Consent, and Control permission model by injecting a library into a running app and inheriting its already-granted permissions without any user prompt. Microsoft rated the issues low risk and declined to fix them, saying some apps need to load unsigned libraries to support plugins.
Bottom line: An app with camera and microphone access, once injected, can record audio and video or send email as the user with no pop-up and no interaction - and the vendor has chosen not to patch it.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026