Unsigned macOS App Vulnerable to Dylib Injection Attacks

The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLD_INSERT_LIBRARIES. An attacker with local user-level code execution can execute arbitrary code within the macOS version of the DigiD app, thereby gaining access to DigiD data and cryptographic capabilities that the process normally does not have. Reported by Kun Peeks (@SwayZGl1tZyyy)

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-103316 exposes a critical flaw in the macOS DigiD application where the absence of Hardened Runtime signing allows local privilege escalation through dynamic library injection. An attacker with local user-level code execution can exploit the DYLD_INSERT_LIBRARIES environment variable to inject malicious dylibs into the DigiD process, gaining unauthorized access to sensitive authentication data and cryptographic capabilities. This vulnerability affects macOS users of DigiD, a widely-used Dutch digital identity verification app, potentially compromising the integrity of identity authentication systems and exposing users to credential theft and unauthorized transactions.

Casky's 224 matching security skills leverage Claude's extended reasoning to map this vulnerability against MITRE ATT&CK technique TA0004 (Privilege Escalation), detecting attack patterns including dylib hijacking, code injection, and process manipulation. Practitioners using Casky would identify detection indicators such as: suspicious DYLD_INSERT_LIBRARIES environment variable usage, unsigned or improperly signed macOS binaries attempting to load external libraries, unexpected dylib injection into high-value processes like authentication apps, and anomalous inter-process communication originating from DigiD. The platform's skill correlation would surface related attack chains—from initial code execution through lateral movement—enabling security teams to implement defense-in-depth controls including code signing verification, runtime integrity monitoring, and environment variable restrictions across their macOS infrastructure.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-103316.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-103316

Casky has 224 skills that investigate the attack patterns behind CVE-2026-103316. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn