macOS malware pins custom root cert via SecTrustSetAnchorCertificatesOnly

Duo Tech@duotech

•updated Jul 2, 2026•2•0•2

This rule detects the use of the 'SecTrustSetAnchorCertificatesOnly' macOS Security framework API call. This API is used to restrict trust to only the anchor certificates provided, which is a technique often used by malware or malicious scripts to bypass security trust controls, intercept TLS/SSL traffic, or facilitate adversary-in-the-middle attacks.