Masquerading × Apple macOS Gatekeeper

bypass Apple's Gatekeeper by replacing a trusted application after initial execution

After gaining initial code execution (e.g., via a malicious script), the attacker replaces a legitimate, trusted application's binary or resources with malicious content while the app is running. Since Gatekeeper only checks at first launch, subsequent executions of the tampered app bypass verification, defeating code-signing and notarization enforcement.

Monitor for unexpected modifications to application bundles (e.g., changes to .app/Contents/MacOS/ binaries) and anomalous process lineage where a trusted app spawns suspicious child processes. Deploy EDR to detect post-exploitation behavior and enforce application whitelisting where feasible.