Silent Replacement of Trusted macOS App Executables

Mac security news usually sounds dry, but this one lit up the comments because it feels less like a hacker movie and more like a sneaky identity theft plot for your apps. Researchers at Mysk say a malicious program can quietly swap out the core file inside a trusted app you already downloaded, then relaunch it without the scary warning people expect from Macs. Even worse, the fake version can ask for access to private stuff like files or saved passwords while wearing the real app’s name and icon. That detail is what really freaked people out: as one commenter basically put it, this sounds like a very polished phishing trick dressed up as your favorite app.

But the real popcorn moment? The comments instantly split into two camps. One side went full “this is bad, actually”, with people wondering why anyone would downplay a trick that could piggyback on a trusted app and quietly run extra malicious code in the background. Another side sounded almost bored, saying, hold on, the attacker already has code running on your Mac, so is this truly a new disaster or just malware doing malware things with extra flair? That argument got spicy fast, especially after Apple reportedly decided the behavior doesn’t need a security fix. And then came the elder-hacker energy: one commenter casually recalled an old similar bug, keylogging tricks and all, plus the classic Apple storyline of “won’t fix”… until maybe it quietly does. In other words: half the crowd is alarmed, half is eye-rolling, and everyone agrees the optics are terrible.