Apple Bug Allows Root Protections Bypass Without Physical Access

Microsoft Threat Intelligence and others warn about CVE-2024-44243, a macOS System Integrity Protection (SIP) bypass patched by Apple (Dec 11). The flaw could allow attackers to install rootkits and persistent malware without physical access; defenders are advised to apply the patch, monitor processes with special entitlements, watch for unusual disk and privileged-user activity, control third-party kernel extensions, and use endpoint detection and least-privilege policies. The report also notes related macOS infostealer activity (Banshee) as an example of threats that can skirt protections.