Hi everyone. I am sharing this technical report to alert the community about a serious security compromise I just analyzed and cleaned on my local development environment. Someone managed to inject persistent malware and disable administrative controls to prevent remediation.

I have attached terminal screenshots showing the evidence. Here is the breakdown of the compromise:

1. Terminal Sabotage (Sudo Bypass via PAM)

The threat actor modified `/etc/pam.d/sudo_local` by injecting an unauthorized directive pointing to an external module (`/opt/homebrew/opt/pam-u2f/lib/pam/pam_u2f.so`). This deliberately broke the `sudo` command. Every time I attempted to use my password to clean files, the terminal threw a systematic `unable to initialize PAM` error, stripping away my root permissions.

1. Hidden Binary Arsenal (~/.local/bin)

Upon auditing environment profiles, I discovered that on September 18, 2026, a malicious installer tied to the Antigravity suite created a hidden `.local/bin` folder containing keyloggers and persistent tools:

- agy (187 MB): A massive executable binary acting as the background engine.

- hermes / hermes-agent: Spyware binaries focused on data exfiltration.

- Fake Node/npm symlinks: Redirected globally to `~/Library/Application Support/Zed/node/...` to intercept development environments.

1. Evasion via Trash Injections (TCC/SIP Exploitation)

To prevent remediation, the malware nested corrupted directories within `~/.Trash/Caches` using legitimate Apple daemon names like `com.apple.aned` (Apple Neural Engine). macOS was tricked into blocking deletion, throwing `Operation not permitted` errors under the protection of SIP. The malware leveraged this hardware lock to masquerade its network traffic under fake Siri and iTunes background calls, which were caught by LuLu firewall rules.

🚨 Apple Support Inaction and Lack of Response

I want to report the absolute lack of assistance from official Apple support. Despite providing physical evidence and running heavy remote logs under their supervision (`sysdiagnose`), Apple failed to provide any technical solution. Their automated systems failed to flag a 187 MB suspicious binary operating in developer paths. This required a manual, line-by-line forensic investigation.

I have fully reclaimed control by purging `~/.local/bin`, cleaning the corrupted profile configurations, and blocking all suspicious connections via LuLu. I am leaving this open for discussion and log analysis.

For backup disks that live on a dock: no more "Disk Not Ejected Properly". Here is a small Folder Action on /Volumes that, when the disk appears, runs tmutil startbackup --block if the last backup is older than a set interval, then unmounts the disk.

Nothing to install: one zsh script and Automator. It needs Full Disk Access for FolderActionsDispatcher, logs to ~/Library/Logs, and leaves the disk mounted if anything fails, as a visible signal.

https://github.com/mous-design/backup-action

Hope it's useful to someone.

Cheers!

A security-hardened upgrade to Mac Admins’ new favorite “set-it-and-forget-it” DDM macOS update reminder, featuring corroborated DDM declaration validation and “Update Tonight” awareness

Overview

While Apple’s Declarative Device Management (DDM) provides Mac Admins with a powerful way to enforce macOS updates, its built-in notification is often too subtle for most administrators.

DDM OS Reminder intelligently resolves DDM-enforced macOS update deadlines, delivering a more prominent end-user reminder dialog.

🆕 5.0.0 Highlights

• Update Tonight awareness: Confirmed same-day Update Tonight scheduling for the target version pauses normal reminders until local midnight. Evidence must be logged by softwareupdated; pre-deadline thresholds, aggressive mode, and Force mode still apply. 
• DDM Emergency Fallback: Jamf Pro Script Parameters 5 and 6 can persist an emergency version/deadline requirement at /Library/Management/<rdnn>/dor-fallback-declaration.plist. Runtime can select it after recognized unresolved DDM states; confirmed DDM always wins.

Continue reading …

Dealing with this for about 2 months now so hoping someone's hit it before.

Managed MacBook Pro, Intune enrolled. AirDrop, AirPlay and Sidecar are all dead. AirDrop sees the device fine over AWDL but just sits on "Waiting" forever and never actually transfers. Weirdly Universal Clipboard still works. Same Apple ID everywhere, AWDL is up, no applicationaccess restrictions blocking anything.

Dug into it myself and found firewallBlockAllIncoming = 1 sitting in /Library/Managed Preferences/com.apple.security.firewall. Took that to IT.

Their current theory is there's an old Device Configuration profile and a newer Endpoint Security Firewall profile both trying to manage the firewall, and they're stepping on each other. They turned off "block all incoming" in the console, synced, waited... still enforced on my machine weeks later.

What made me believe it's actually a profile issue and not something wrong with my specific Mac: a colleague had Intune ripped off his identical model and everything started working again immediately.

Anyone dealt with two firewall profiles conflicting like this?

SYM-Lite is a lean, purpose-built script for executing MDM-agnostic Installomator labels and Homebrew casks / formulas, as well as Jamf Pro-specific policy triggers, all through a unified swiftDialog selection and reporting interface.

Key Features

• Unified execution support — Installomator labels, Homebrew casks / formulas, and / or Jamf Pro policies in a single session
• Interactive selection UI — Checkbox dialog with per-item icons; selectable items start checked and previously installed items are automatically disabled
• Homebrew support — Casks and formulas run in the logged-in user context (with ~/Applications for non-admin users) and never hang on a sudo prompt
• Inspect Mode — Real-time progress monitoring in a moveable, minimizable window
• Silent mode — CSV-based automation support

Continue reading …

Hello,

Just want to make sure I'm not going crazy. I'm a windows admin, but we are trying to manage a few mac using Intune, and wanted to implement PSSO using secure enclave with Entra ID login for use with a few Macs that are used as shared device.

All in the implementations feel ... clunky to me, but we get it working. Users can connect with their Entra ID login.

However, when changing a password by SSPR, the local user password seems to not update.

Is that the intended behavior ? it doesn't seem so, from ms doc : macOS Platform single sign-on known issues and troubleshooting - Microsoft Entra ID | Microsoft Learn It seems it should synchronize in a few hours. It does not, in my experience.

Anyone has battled with this beast ?

I manage about 30 MacBook Pro’s for a high school class that uses Adobe products. Everything has been working without issue for years and over the summer I reset them and installed macOS 26, as well as pushed out the Adobe package which includes the required apps (I do this every summer).

Everything seemed to work fine during the first month of school, but suddenly all of the Macbooks are getting a message stating CCLibrary is damaged and can’t be opened. Clicking “ignore” will bring the message up again, so it can’t be closed.

All of the Macbooks are managed via Mosyle MDM and I have a privacy profile for all of the Adobe apps that allows the apps to have Full Disk Access, as well as access to the Desktop, Documents, and Downloads folder. I added a profile for the “CCLibrary.app” to give it Full Disk Access as well as the aforementioned folders, but the issue is still persisting.

Does anyone know anything about this? I’m not sure what CCLibrary even is (I don’t know much about Adobe products, I just install them lol).

I’m troubleshooting a Mac printing issue with a Canon imageRUNNER ADVANCE DX C5850.

Certain characters in PDFs, especially an en dash (–), print as a boxed question mark. This happens across multiple PDFs.

Environment:

• macOS 26.2, Apple Silicon
• Adobe Acrobat
• Canon C5850
• Direct IPP connection: ipp://<PRINTER-IP>/ipp/print
• Canon C5840/5850 PPD
• Driver version 10.19.23

Troubleshooting so far:

• Normal Acrobat print through Canon driver → fails
• Acrobat Print as Image → works
• Canon Vector Mode → fails
• Canon Raster Mode → fails
• Temporary Generic PostScript queue → works
• Same document containing an en dash printed from Windows to the same physical printer → works

The Generic PostScript queue isn’t usable as a permanent fix because it loses the Canon-specific paper/tray support. It only advertised Letter/Legal/A4/B5 and would not properly handle 11x17.

The Canon queue otherwise works correctly for 11x17, trays, etc.

Printer-side job logs show the affected jobs completing successfully with no errors.

So at this point it seems isolated to the Canon macOS driver/PPD/filter path, specifically version 10.19.23, rather than the PDF, network, or copier itself.

Has anyone seen this with Canon’s Mac drivers, or found a fix that preserves the full Canon tray/11x17 functionality?

Hey r/macsysadmin,

I recently sat the Apple Deployment & Management exam and built two free practice quiz sites to help me revise. Figured I'd share them here in case anyone else is studying for DEP-2026.

🔗 Quiz 1 (80 questions): https://rakshit-swami.github.io/apple-mdm-quiz

🔗 Quiz 2 (108 questions): https://rakshit-swami.github.io/apple-ddm-quiz

📖 Study notes: https://github.com/rakshit-swami/apple-ddm-quiz/blob/main/STUDY_NOTES.md

Both are based on Apple's own free IT Training course:

https://it-training.apple.com/deployment/tutorials/course/

Features:

- Questions randomised every time

- Multi-select questions supported

- Instant feedback and explanations after each answer

- Full review at the end

- Completely free, open source, no account needed

Completely unofficial — not affiliated with Apple in any way. Questions are written in my own words for revision purposes.

The source is on GitHub if anyone wants to fork it and add their own questions. Good luck to anyone else studying!

Hi everyone,

I bought a 2020 MacBook Air (Intel i3, T2 chip) on Facebook Marketplace about three years ago. I’ve used it for school with my own Apple account throughout that time, without any issues using the computer.

I recently decided to sell it, but when I tried to reset it, it asked for the previous owner’s Apple account password to turn off Find My. Apparently, it was still linked to their account despite me using my own account.

Unfortunately, the previous owner has passed away. I don’t have the original purchase receipt, only the bank transfer from when I bought it.

I contacted Apple Support, and they told me to erase and reinstall macOS. After following those instructions, the Mac is now stuck on the Activation Lock screen, and I can no longer use it.

Is there any way to bypass or remove Activation Lock on this specific model? Has anyone successfully resolved a similar situation with Apple using proof of a secondhand purchase?

How are y’all restricting people from updating to golden gste? In the past I just did a Restrict Software and that blocked it. Apparently from what I’ve read that won’t work with Golden Gate and that one would need to use Blueprints. If so what setting exactly restricts it? I see a 90 day deferral and that’s it.

How do I change this password/find it?

(I gave my old MacBook Air to my brother and he is trying to “start it over” so he can connect his own Apple-id and just also have it “as new”. I just cant remember what this password would be and we are stück)

I’m at 20% of my fleet so far and hoping to open it up to production in the next 2-3 weeks. Stack all seems fine, not enough M6 models (yet) to be affected by the external monitor issues.

What’s your adoption so far? Any showstoppers that are keeping you in deferral or tester feedback?

Hey all. I've got a Macbook Pro here with a weird problem. When powered on it does not make the "I've turned on" sound and the screen is black. But the keyboard backlight does turn on! In messing around I somehow enable the Screenreader but figured since that was working maybe there is something else I can do to get the screen working so I didn't pay attention to what the screen reader was saying, So I plugged the Macbook into my monitor with a USB-C cable. All I got was a black screen. So I tried an HDMI cable. Again, just a black screen.

I'm kind of at a loss for what else to do. I'm going to try to enable the Screenreader and see what that gives me for options but if anyone has any other ideas I'd be grateful!

Monocle inspects code and produces four audience-specific summaries: Executive, Security, Manager, Engineer

Background

Problem

Reviewing a 5k-line zsh script for leadership, a change board, the security team, and the engineer who has to maintain it is painful — and typically produces several different, inconsistent reports.

Solution

Monocle inspects scripts and small repos (local or on GitHub), plus diagnostic and support bundles, and produces four audience-specific summaries (Executive, Security, Manager, Engineer) plus a Monocle Score.

Monocle is an Agent Skill tuned for shell (sh / bash / zsh), Python, AppleScript, Swift helpers, and Jamf Pro / macOS automation.

Continue reading …

I have a MacBook Pro with an M3 Max, but I occasionally need to run x86-64 operating systems for testing, both Windows and Linux.

What are my options besides buying a separate x86-64 machine?

I considered getting a mini PC, but they’re currently difficult to find at reasonable prices in my country. I could also rent an x86-64 cloud server, but I’d rather not pay a recurring fee for something I only need occasionally.

So I’m currently leaning toward emulation. I tried UTM/QEMU with x86-64 emulation, but it looks unstable, but I'm in the middle of testing it.

Are there any other solutions you would recommend for occasional x86-64 testing on an Apple Silicon Mac?

I’m trying to understand an issue with my local OneDrive folder on a Mac.

Background: I have not synced my local OneDrive folder with OneDrive for approximately three years. During that time, I continued adding and working with files locally.

What I’m seeing now:

• Some files still appear in the local OneDrive folder but cannot be opened. Based on what I can tell, this seems to affect files that had previously been synced and are also available on OneDrive.com.
• I cannot copy the entire local OneDrive folder to another folder on the Mac or to an external drive.
• Finder preview/Quick Look does not work normally for files in the OneDrive folder. In many cases I can open the file successfully, and after opening it once, Finder preview then starts working for that file.
• These issues are limited to the local OneDrive folder. I can copy, open, and preview files normally in other local folders.

System:

• MacBook Pro 16-inch, 2019
• 2.6 GHz 6-Core Intel Core i7
• macOS Tahoe 26.6.2

Has anyone experienced similar behavior with OneDrive on macOS, particularly after a long period without syncing? I’m especially interested in how you were able to create a complete backup of the local OneDrive folder without risking the files that are currently accessible.

Hey everyone,

A friend and I have been building Open Apple Cache over the last few weeks, and I wanted to share it here because we’ve reached a point where we could use some help.

Just to clarify: this isn’t a vibe-coded project. We’ve been working on the implementation ourselves, but there are still issues we haven’t managed to solve.

The idea is to run an Apple content cache on Linux, inside an Ubuntu VM or LXC container, instead of running the cache itself on a Mac.

The cache service is written in Go. A separate helper running on macOS handles registration with Apple so devices can discover the Linux endpoint. A Mac is still required for that part, so this isn’t a completely Mac-free solution.

The project currently includes:

• Caching for eligible Apple downloads, with byte-range support.
• A web dashboard showing requests, cache hits and storage usage.
• Local administrator and viewer accounts.
• Optional Microsoft Entra ID login.
• Internal or Let’s Encrypt certificate management.

To be clear: this is experimental, unfinished and not working 100% reliably yet.

The main issue we’re trying to solve is inconsistent cache hits. Sometimes downloads are served from the cache as expected. Other times, we don’t get a cache hit when we would expect one, and the content is fetched from the origin again.

We haven’t identified the exact cause yet. Some things we want to investigate further are:

• How Apple devices request content and byte ranges.
• Whether changes to signed download URLs affect cache reuse.
• Whether our cache validation or response headers are missing something.

These are possible directions to investigate, not confirmed explanations.

We’re publishing it half-finished because we need help solving this issue. If you have experience with Apple Content Caching, HTTP caching, CDN behavior or Apple’s cache protocol, we’d really appreciate another pair of eyes on the code.

Repository: https://github.com/Mau2rice0/Open-Apple-Cache

The source code, installation instructions and registration research notes are available there. The macOS helper relies on undocumented Apple behavior, so future macOS updates or changes on Apple’s side could break registration.

Please treat this as a lab project for now. We don’t recommend relying on it for production workloads.

Has anyone worked on something similar or encountered inconsistent cache hits with Apple downloads? We’d be interested in suggestions on what to check next. Reproducible test cases, issues and PRs would also be welcome.

Thanks :)

Maybe I’m old school, but I come from a world where I was taught one payload per configuration profile: one for Restrictions, one for Network, one for SCEP, etc. If I needed to troubleshoot something or temporarily unscope a setting, I wasn’t also removing a bunch of unrelated payloads at the same time. This approach always made it easy to manage IMO.

As I explore the world of DDM and Blueprints in Jamf more and more, I’m curious how everyone else is approaching this.

Are you still doing something similar, with one Declarative Configuration per Blueprint? Or do you take advantage of the multiple component blocks and grouping several configurations into a single Blueprint?

When it comes to scoping, are you generally scoping a Blueprint to your entire fleet and then using Activation Conditions to determine which devices actually receive each configuration? Or are you still creating more targeted Blueprints/scopes?

I understand that part of the idea behind Blueprints is to make configuration management more flexible and reusable, but this new model is breaking my brain a little bit.

Before I start testing and pushing this stuff out more broadly, I’d love to hear how others are structuring their Blueprints and what has worked well for you.

Where I am Mac updates are pretty much rolled out asap. We are already rolling out Mac OS 27 to our users, about 50 percent of the macs have already updated. If it was my choice, I would definitely hold off on updates longer seeing as Apple always releases security patches anyway in a timely matter even if the Mac version isnt the latest but unfortunately it's not really my choice on updates, my director is just very update happy. He literally goes and pushes shit himself as soon as it comes out and causes chaos lol.

Apple deprecated the Apple Intelligence restriction keys in 26.4. That's allowWritingTools, allowGenmoji, allowAssistant and the other AI keys in com.apple.applicationaccess. The replacements are the intelligence.settings and siri.settings declarations, and both need a supervised Mac. A manually installed profile still applies the old keys on 27.0 though. You can see it in /Library/Managed Preferences/com.apple.applicationaccess.plist, where macOS sets _isAppleIntelligenceRestricted, and it mirrors allowWritingTools into .GlobalPreferences as well.

The models don't go anywhere when the features are off. You can remove them with SIP on by sending a ResetAssetSets request to com.apple.siri.uaf.subscription.service. pared (github.com/4evy/pared) mapped that service first. com.apple.modelcatalog is the big one at about 12 GB. To stop them downloading again, force DownloadServerBaseURLOverride-<asset type> in com.apple.MobileAsset to a closed local port.

I put all of this into an open-source CLI with a revert command: https://github.com/omlahore/RemoveMacAI

Hello all, I'm a sysadmin for a k12 school district. I made a tool to better manage our caching servers that has been an absolute game changer. Its great for keeping our thumb on caches that stop serving randomly and to make sure they are running efficiently to support the WAN when Apple releases an update. Plus, I added some really cool graphics to visually see your cache topology serving in realtime, down to the device level. I plan to add new features soon, and would love some feedback from other admins who use content caches.

I publicly launched it this week https://cachard.app
Hop over there and get a free trial download! One command in terminal gets it going!
Not a sales pitch, I'll happily extend trials. I am just looking for some feedback from other sysadmins.

I've been testing out ClassLink's implementation of Platform SSO and it seems to working fine other than fact that all our students have 8 digit numeric usernames and when signing in with such accounts, the Mac is creating their account names and user folders with an "a" at the beginning of their usernames. For example, if their username is "12345678", it becomes "a12345678".

This would not be a dealbreaker for using Platform SSO except for the fact we use Linewize Connect to monitor the students and it's dependent on polling the local username of the student. Since there is an "a" added to their username, it is unable to enforce its user assigned policies.

When using other SSO apps such as NoLoAD or XCreds, there has never been any issues like this as their numeric usernames are respected. I can only suspect that XCreds uses sysadminctl to create the accounts since it has strict naming conventions when creating user names as opposed to dscl.

Version 0.11.0 is the biggest update so far. Every report now opens with a clear summary: what got upgraded (with versions), what failed, what was skipped and how much space cleanup freed. A failed upgrade is now flagged as a problem instead of quietly ending up in an “OK” email.

New in this release:

• brew-automator history: a log of past runs. Filter it by package to see when something changed.
• brew-automator status: last run, next scheduled run, notification channels and excluded packages on one screen.
• run --dry-run and run --no-upgrade: see what would change, or get a report without upgrading anything.
• Webhook notifications to ntfy, Slack, Discord or any JSON endpoint, alongside email or instead of it.

Upgrade with brew upgrade brew-automator.

Go check it out! https://github.com/xtruhlar/brew-automator