Researchers replace downloaded macOS apps with evil twins, Apple shrugs

Security researchers Talal Haj Bakry and Tommy Mysk disclosed a Gatekeeper bypass in macOS that permits replacing the main executable of apps downloaded from the internet (but not App Store apps) after they have been run once. The technique archives and restores the app bundle (for example with tar), causing macOS to treat the bundle as locally built and skip revalidation, enabling malicious replicas to be executed without elevated privileges; Apple was notified and closed the report.