Skip to content
Threat Feed

Tag

Kernel-Extension

1 brief RSS
medium advisory

macOS Kernel-to-Userland Process Creation Notification via undocumented kev_msg_post

The kev_msg_post function can be abused by malware to broadcast process creation notifications from a kernel extension (kext) to a user-mode application, potentially bypassing security tools that rely on standard APIs and leading to undetected malicious activity.

BlockBlock kernel-extension kev_msg_post macos process-monitoring
2r