macOS CDC-ACM serial class bypasses TCC, Lockdown Mode, and USB Restricted Mode. A USB composite device exfils SSH keys, cloud creds, keychain metadata in 24 seconds...

glyph.sh/posts/macos-cdc-acm-tcc-bypass/

#infosec #macOS #Apple #TCC #LockdownMode