# How a macOS bug could have allowed for a serious phishing attack against users

macOS followupd failed to validate XPC clients, letting any app (even sandboxed) post fake Apple ID verification prompts to phish credentials.

- Payout: $5,000
- Severity: medium
- Program: Apple
- Credited: Guilherme Rambo
- Disclosed: 2022-03-14
- CVE: CVE-2022-22660
- Write-up quality: 7/10
- Original: https://rambo.codes/posts/2022-03-15-how-a-macos-bug-could-have-allowed-for-a-serious-phishing-attack-against-users
- Library page: https://bugbountylibrary.com/r/blog%3Arambo-codes-posts-2022-03-15-how-a-macos-bug-could-have-allowed-for-a-serious-phishing-attack-against-users
- Tags: domain:desktop impact:ato impact:data-leak kind:bounty platform:blog sev:medium technique:source-review vuln:access-control vuln:auth-bypass vuln:misconfiguration

**Target:** macOS followupd XPC/Mach service (CoreFollowUp)
**Root cause:** The followupd daemon did not authenticate connecting processes on its Mach service, so any local process including sandboxed apps could register follow-up notifications and control the URL launched by the 'Verify Now' button.
**Steps:**
1. Look up the followupd Mach service from a sandboxed app
2. Connect without any entitlement check (pre-12.3)
3. Send a command registering a follow-up notification mimicking 'Verify your Apple ID information'
4. Set the action URL to an attacker-controlled Apple ID login panel
5. Victim clicks 'Verify Now' in System Preferences and submits Apple ID email/password to attacker
**How found:** Researcher examined how CoreFollowUp/followupd handles XPC connections and noticed the daemon accepted connections from any process without validating the caller's identity or entitlements.
**Exploitation:** A malicious app posts a convincing System Preferences alert; the victim enters Apple ID credentials into the attacker-controlled panel, which forwards them. Attacker then authenticates on their own machine, triggers a 2FA prompt on the victim's device, and social-engineers the code to complete account takeover.
**Escalation:** Chained credential phishing with a live 2FA relay to achieve full Apple ID account takeover; also extracts account info pre-2FA.
**Insight:** Audit privileged XPC/Mach daemons for missing caller validation—check whether the service enforces entitlements or code-signing checks on connecting processes, and whether UI-triggering actions (dialogs, URL launches) can be driven by unprivileged or sandboxed clients.