Mac apps can be swapped for malware

Researchers Talal Haj Bakry and Tommy Mysk found a macOS vulnerability that lets attackers silently replace the main executable of web-downloaded apps without elevated privileges. The exploit requires the user to archive and re-extract the app. Mac App Store apps are not affected. Apple considers this social engineering, not a security bypass.