macOS ‘Sploitlight’ Vulnerability Let Attackers Steal Private Data of Files Bypassing TCC

A critical macOS vulnerability enables attackers to bypass Transparency, Consent, and Control (TCC) protections and steal sensitive user data, including files from protected directories and Apple Intelligence caches. 

The vulnerability, dubbed “Sploitlight,” exploits Spotlight plugins to access normally protected information without user consent, posing significant privacy risks for macOS users.

Key Takeaways
1. The "Sploitlight" flaw let attackers steal sensitive macOS data.
2. Attackers could access private files across devices linked to the same iCloud account.
3. Apple fixed the issue (CVE-2025-31199) in March 2025

Spotlight Plugin Exploitation Mechanism

Microsoft Threat Intelligence reports that the vulnerability leverages Spotlight importers – plugins with .mdimporter extensions that help index system content for search functionality. 

These plugins operate through the mds daemon and mdworker tasks, which possess privileged access to sensitive files for indexing purposes. 

However, researchers discovered that attackers can manipulate these plugins to exfiltrate protected data.

The attack process involves modifying a plugin’s Info.plist and schema.xml files to declare target file types in UTI (Uniform Type Identifier) format. 

Attackers can then copy the unsigned bundle to the ~/Library/Spotlight directory and use commands like mdimport -r to force Spotlight to load the malicious plugin. 

The exploit logs file contents to the unified log in chunks, allowing extraction of sensitive data through the log utility.

Notably, the calling application doesn’t require TCC permissions since the indexing is performed by the mdworker task, effectively bypassing Apple’s security framework. 

The uttype utility can determine file types even without TCC access, making the attack more versatile.

The vulnerability’s implications extend beyond basic file access, particularly affecting Apple Intelligence caches stored in protected directories like Pictures.

Attackers can extract highly sensitive information from databases such as Photos.sqlite, including precise GPS coordinates, face recognition data, photo metadata, search history, and user preferences.

The breach becomes more concerning due to iCloud account linking, where attackers accessing one macOS device can potentially gather information about other devices connected to the same iCloud account. This includes face tagging and metadata that propagates across Apple devices.

Apple addressed this vulnerability, now tracked as CVE-2025-31199, in security updates for macOS Sequoia released on March 31, 2025. 

Microsoft Defender for Endpoint has enhanced its detection capabilities to identify suspicious .mdimporter bundle installations and anomalous indexing of sensitive directories.

Users are strongly advised to apply Apple’s security updates immediately to protect against this TCC bypass vulnerability, which represents a significant threat to user privacy and data security.

Experience faster, more accurate phishing detection and enhanced protection for your business with real-time sandbox analysis-> Try ANY.RUN now