SILENT REPLACEMENT OF TRUSTED MACOS APP EXECUTABLES

Summary from the TLDR InfoSec newsletter

Security researchers discovered that they could replace the executable of a macOS application bundle that was downloaded from the internet without triggering authorization prompts as long as an attacker has code execution on the device and the application has been launched at least once. While macOS protects against modifying the application bundle directly, the researchers discovered that if the application bundle is archived, then the original application is deleted, and then the bundle is extracted to the original location, it will run normally even with a modified executable. Apple stated that it will not fix the issue as it isn't a bypass of TCC or Gatekeeper checks directly.