Researcher and ex-NSA staffer Patrick Wardle shows how malware could use AppleScript and a macOS feature called “mouse keys” to bypass security prompts on macOS
Andy Greenberg / Wired :
Context & Ripple Effects
Patrick Wardle's mouse-keys demonstration is another entry in a decade-long series where he shows that macOS's layered defenses hold up worse than their reputations suggest. Back in 2016 he criticized Apple for merely blacklisting programs exploiting a Gatekeeper vulnerability rather than fixing the underlying cause, and later work found apps running despite failing Apple's notarization checks before Big Sur 11.3 patched the hole.
The through-line matters here: the mouse-keys trick needs no kernel exploit at all, just AppleScript driving an accessibility feature against the very prompts meant to stop it. That puts it in the same family as his later finding that Apple's Background Task Management tool is trivially bypassed by somewhat sophisticated malware.
First-order effects
- Users who treat macOS security prompts as a reliable gate are exposed: malware can approve its own installation by scripting the interface instead of defeating the check behind it.
- Apple faces pressure to patch or constrain mouse keys and similar accessibility features, since the attack path runs through built-in OS functionality rather than a third-party bug.
Second-order effects
- Attackers gain a template that favors scripting legitimate system features over expensive zero-days, shifting Mac malware development toward automation of trusted interfaces.
- The finding undermines confidence in Apple's notarization pipeline as a standalone control — a concern reinforced when researchers later surfaced adware that was itself notarized by Apple and survived takedown only until a new variant appeared.
Third-order effects
- If each defensive layer — Gatekeeper, notarization, Background Task Management — keeps proving scriptably bypassable, macOS security consolidates around behavioral detection rather than prompt-based consent, and Apple's fix cadence becomes the real perimeter.
- Wardle's repeated disclosures establish independent researchers as the de facto stress-testers of Apple's security claims, a role regulators and enterprise buyers increasingly weigh when assessing platform trust.
The trend: Mac security is drifting from single-gate mechanisms toward layered, behavior-based defense, as researchers keep showing each individual gate — from Gatekeeper to Background Task Management — can be scripted around.