macOS Tahoe code injection → Spotlight

Runtime code injection into Apple's Spotlight on macOS 26 (Tahoe), Apple Silicon.

An unsigned dylib gets loaded into the live Spotlight process and hooks the method Spotlight uses to build search results, so it can see, and change, everything you type.

Watch the demo video here]

I have deliberately kept the payload as a template. You are free to expand on it and make it yours in whatever way you please. The sky's the limit once you are in!

Requirements

• Apple Silicon (the injection path is arm64e-specific).
• macOS 26 (Tahoe). The Spotlight method name is version-specific; on a different build it may have moved.
• SIP disabled, and boot into an environment that allows unsigned code into signed processes:

  csrutil disable                       # from Recovery
  sudo nvram boot-args="amfi_get_out_of_my_way=1 -arm64e_preview_abi" # in a normal boot environment
  

  THESE COMMANDS LEAVE YOUR MACHINE VULNERABLE TO CYBER ATTACKS. DISABLE AT YOUR OWN RISK!!! This is a research setup.

How to run

1. Build the injector:

clang -arch arm64e -Wall -Wno-deprecated-declarations -o inject inject.m
codesign -fs - inject

2. Build the payload (ad-hoc signed, no entitlements):

clang -fobjc-arc -arch arm64e -dynamiclib -framework Foundation -o swizzle_demo.dylib swizzle_demo.m
codesign -fs - swizzle_demo.dylib

3. Inject it into Spotlight. Restart Spotlight first so you're loading into a fresh process, then pass its pid and the absolute path to the dylib:

killall Spotlight; sleep 2
sudo ./inject $(pgrep -x Spotlight) "$(pwd)/swizzle_demo.dylib"

The path is passed as an argument, not baked in; "$(pwd)/…" keeps it portable. If pgrep comes back empty, hit ⌘-Space once (then Esc) to make macOS relaunch Spotlight.

4. Watch it work. A dylib inside Spotlight has no visible stdout, so read its log:

log stream --predicate 'eventMessage CONTAINS "[demo]"' --style compact

Now type in Spotlight, and every keystroke logs the query it intercepted.

Credit

The inspiration for this injector comes from Jeremy Legendre (@jslegendre).

Legal

For security research and education on machines you own. Don't point it at anything you don't have permission to touch. Disabling SIP and AMFI without knowing what you're doing leaves your machine vulnerable to cyber attacks. DO NOT disable without knowing these risks.