Keynote: Dylib Hijacking on macOS: Dead or Alive? I Patrick Wardle

Over a decade ago, Patrick revealed that macOS (then OS X) was vulnerable to what had long been considered a Windows-only attack: dynamic library hijacking. By simply planting malicious libraries in the right place, attackers could achieve stealthy persistence, inject code into trusted processes, and even bypass core Apple security features. In this talk, he revisits that original research, walks through how real-world macOS malware has abused the technique over the years, and examines the aggressive mitigations Apple introduced to stop it. Fast-forward to macOS 26 and one question remains: is dylib hijacking finally dead, or still alive and well? Come for the history, stay for the live demos, detection tips, and a few surprises. — Speaker: Patrick Wardle I Objective-See Foundation / DoubleYou Patrick Wardle is the founder of the Objective-See Foundation, the CEO/Cofounder of DoubleYou, and the author of "The Art of Mac Malware" book series. Having worked at NASA and the NSA, as well as presenting at countless security conferences, he is intimately familiar with aliens, spies, and talking nerdy. Passionate about macOS security, Patrick spends his days discovering Apple 0days, studying macOS malware, and releasing free open-source security tools to protect Mac users. — Follow us on social media! X:   / ekoparty   LinkedIn:   / 1053378   Instagram:   / ekoparty   Facebook: https://www.facebook/ekopartyconference Twitch:   / ekoparty   Visitá nuestra web: https://www.ekoparty.org/