# Researchers replace macOS apps with malicious clones, exposing Gatekeeper flaw Apple's security mechanism fails to detect tampered applications downloaded from the web. - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-07-23 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/161faf11-f02e-4b07-af72-cc24fd24d768 ## Gatekeeper's Vulnerability Apple's Gatekeeper security mechanism in macOS contains a flaw that allows downloaded applications to be replaced with malicious versions. Researchers demonstrated how app bundles can be modified to exploit this weakness. ## Attack Methodology Attackers can archive executed apps using tar and replace them with malicious versions. Despite detecting changes, macOS skips revalidation due to cached trust data, creating a security blind spot. ## Affected Applications Popular apps like Brave, Slack, Signal, and Visual Studio Code—downloaded outside the Mac App Store—are vulnerable. App Store-distributed apps remain protected by root permissions. ## Potential Attack Vectors Command-line tools, terminal command injections, or supply chain attacks via package managers can exploit this flaw. Attackers may also display deceptive prompts leveraging the app's trusted appearance. ## Apple's Stance Apple dismissed the issue by categorizing modified apps as 'locally built bundles' outside its security scope. The company considers social engineering aspects beyond its responsibility. ## User Risks This vulnerability increases risks of unauthorized data access and system compromise. Developers and enterprise users should regularly verify application integrity, especially for web-downloaded software. ## Sources covering this story - https://www.theregister.com/security/2026/07/24/researchers-replace-downloaded-macos-apps-with-evil-twins-apple-shrugs/5277858 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._