macOS Attack Technique Silently Disables EDR and MDM Tools Without Admin Privileges Cybersecurity firm XM Cyber has uncovered a novel macOS attack method that allows a standard, non-administrative user to disable enterprise endpoint security tools including EDR and MDM agents without triggering alerts or requiring kernel exploits. The technique leverages legitimate macOS behaviors rather than software vulnerabilities, making detection difficult. The attack exploits weakly validated XPC connections and the injection of malicious payloads into application Interface Builder (NIB) files, techniques previously documented but never chained in this way. A key component involves abusing the persistence of the kernel’s code-signing trust cache after a signed application executes, enabling attackers to impersonate trusted app components and invoke privileged XPC methods undetected. XM Cyber demonstrated the technique against CrowdStrike Falcon Sensor, which was fully unloaded from a standard user account, and Kandji MDM, which was permanently deactivated via a two-stage exploit that cleared EDR protections and terminated the Endpoint Security Framework extension. A third, unnamed enterprise EDR vendor was also successfully targeted and is working on a patch. Vendor Responses: - CrowdStrike paid a bug bounty and implemented detection measures. - Kandji patched the flaw and assigned CVE-2026-39118. - Apple has not yet publicly commented. Researcher Hillel Pinto will release an open-source tool, XPC Hunter, to automate the detection of exploitable XPC privilege escalation surfaces across macOS applications. A full presentation is scheduled for Black Hat US in August 2026. The findings highlight persistent risks in macOS security, even as Apple continues to address legacy attack vectors.