Shift Left and Hunt Deep: Announcing Automated Exposure Discovery Engines for macOS XPC and Oracle Cloud IAM

What it is

Two open-source offensive toolsets from XM Cyber. FAInd my XPC (XPC Hunter) is an automated framework that discovers macOS privileged XPC services and proves privilege escalation end-to-end — from an unprivileged, non-admin account to root code execution — against services that authorize callers by code-signing identity alone. pOliCI and a CLI Signing Helper (a fork of the OCI CLI) analyze Oracle Cloud Infrastructure IAM for privilege-escalation paths.

How it works

The XPC attack targets a class of flaw, not one bug: apps that expose privileged (often root) XPC services and gate callers only by team ID / CDHash. The chain:

• Inventory — enumerate apps, daemons, helpers; flag those running a root process that also ship an injectable NIB/UI resource.
• Inject & Prove — prime the AMFI/CDHash code-signing cache and swap a sealed NIB resource in a trusted signed app, then confirm the injected JXA payload actually executes.
• Recon — from inside the trusted process, map which privileged root XPC services the injected client can reach.
• Reverse — an AI agent (Claude) decompiles each reachable daemon to recover exposed methods, argument/reply signatures, protocols, and the code-signing acceptance predicate.
• Fire & Verify — issue a real NSXPC call to a privileged method; a second AI agent inspects filesystem/process/log evidence to confirm the concrete outcome rather than assuming success.

The core mechanism worth internalizing: dynamic code-signature validation verifies the trusted process's code identity but not the swapped NIB resource it loads, so the attacker's code runs inside a signed app and inherits its identity without modifying any signed executable. Static analysis uses otool and __objc_methtype protocol/method-signature extraction plus Mach-service discovery.

Preconditions / Affected

Exploitable only when an XPC service trusts callers solely by code-signing identity (team ID / CDHash). The page states this was demonstrated as unauthenticated root code execution in shipping endpoint-security software. The attacker needs only a local unprivileged account.

What to do

The stated defensive boundary is the actionable takeaway: services that additionally enforce per-action authorization or launch-constraint / identifier pinning are not exploitable this way, and FAInd my XPC distinguishes the two automatically. If you ship a privileged XPC helper, add per-action authorization or launch constraints rather than relying on code-signing identity checks. For OCI, run pOliCI to expand IAM policy statements against Oracle's permission reference data and compute effective per-principal permissions to find over-privileged identities.

Caveats

No CVE, version, or vendor names are given for the affected endpoint-security software. Availability is tied to BlackHat USA 2026 Arsenal (XPC, Aug 6) and DEF CON 2026 (OCI tools); the page does not link the repositories directly.