macOS quarantine attribute removal with ad-hoc code signing (Gatekeeper bypass)

Duo Tech@duotech

•updated Jul 6, 2026•2•0•4

Detects a sequence of actions on macOS where an attacker removes the quarantine extended attribute (com.apple.quarantine) using 'xattr' and subsequently performs ad-hoc code signing using 'codesign' on the same system. This behavior is indicative of an attempt to bypass macOS Gatekeeper security controls to execute untrusted or malicious binaries.