macOS TCC bypass via correlated Time Machine snapshot mount and TCC.db injection

Duo Tech@duotech

•updated Aug 19, 2026•4•0•6

Detects the AmnesiaStealer TCC-bypass chain: correlated Time Machine local snapshot creation/mounting (recycling CVE-2020-9771), hidden snapshot marker files, and direct SQLite injection into a mounted TCC.db copy to grant Full Disk Access, followed by killing tccd to force a reload.