CVE-2024-54471: macOS NetAuthAgent MIG Server Flaw Enables Credential Leakage and iCloud Data Access

Key facts for NetAuthAgent credential leak

Detection coverage for NetAuthAgent credential leak

As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4835 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: iCloud API Access by Scripting Clients or Non-Apple Processes (Stolen Token Use) — C2 / Lateral Movement (SPL)

Detects use of stolen long-lived iCloud API tokens: curl, python, node, ruby, perl or swift command lines targeting iCloud service hosts (setup, gateway, fmipmobile, and pNN- contacts, calendars, keyvalueservice, ckdatabase, fmip, quota), and non-Apple processes connecting to icloud.com hosts. These tokens, recoverable via CVE-2024-54471, give access to contacts, calendars, Find My, key-value store, backup metadata and CloudKit from any host, so token use from unexpected systems is the post-exploitation signal.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1550.001, T1078.004, T1530, T1528
• Data sources: osquery, microsoft_defender_for_endpoint
• Severity: medium
• Confidence: medium

Splunk SPL

index=macos sourcetype="osquery:results" earliest=-24h
| eval proc=lower(coalesce(path, process_path, "")), cmd=lower(coalesce(cmdline, command_line, "")), dhost=lower(coalesce(dest_host, remote_hostname, ""))
| where (match(cmd, "(curl|wget|python|node|ruby|perl|swift)") AND match(cmd, "(setup|gateway|fmipmobile|p[0-9]+-(contacts|calendars|keyvalueservice|ckdatabase|fmip|quota))[.]icloud[.]com")) OR (match(dhost, "[.]icloud[.]com$") AND NOT match(proc, "^(/system/|/usr/libexec/|/applications/|/library/apple/)"))
| stats count values(proc) as processes values(dhost) as icloud_hosts values(cmd) as commands by host
| table host processes icloud_hosts commands count

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl endswith ".icloud.com"
| where InitiatingProcessFolderPath !startswith "/System/" and InitiatingProcessFolderPath !startswith "/usr/libexec/" and InitiatingProcessFolderPath !startswith "/Applications/" and InitiatingProcessFolderPath !startswith "/Library/Apple/"
| summarize Connections = count(), Hosts = make_set(RemoteUrl, 20), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine
| project DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, Connections, Hosts, FirstSeen, LastSeen

Sigma

title: Scripting Client Calling iCloud API Hosts on macOS (Stolen iCloud Token Use, CVE-2024-54471)
id: b4d8e3f7-61c2-4c9a-a7e5-9f2d1c0b8a03
status: experimental
description: Detects curl, python, node, ruby or perl command lines targeting iCloud service hosts such as setup, gateway, fmipmobile, contacts, calendars, keyvalueservice, ckdatabase and fmip, consistent with replay of long-lived iCloud API tokens obtained through the NetAuthAgent flaw (CVE-2024-54471).
references:
    - https://objective-see.org/blog/blog_0x7E.html
    - https://wts.dev/posts/password-leak/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-30
tags:
    - attack.credential_access
    - attack.t1528
    - attack.defense_evasion
    - attack.t1550.001
    - attack.collection
    - attack.t1530
    - attack.initial_access
    - attack.t1078.004
    - cve.2024-54471
logsource:
    category: process_creation
    product: macos
detection:
    selection_img:
        Image|endswith:
            - '/curl'
            - '/python'
            - '/python3'
            - '/node'
            - '/ruby'
            - '/perl'
    selection_host:
        CommandLine|contains:
            - 'setup.icloud.com'
            - 'gateway.icloud.com'
            - 'fmipmobile.icloud.com'
            - '-contacts.icloud.com'
            - '-calendars.icloud.com'
            - '-keyvalueservice.icloud.com'
            - '-ckdatabase.icloud.com'
            - '-fmip.icloud.com'
    condition: selection_img and selection_host
falsepositives:
    - Developers testing iCloud or CloudKit APIs from scripts
    - Legitimate third-party sync or backup tooling that calls iCloud endpoints
level: medium

Known false positives:

• Developers testing iCloud or CloudKit APIs from scripts
• Legitimate third-party sync or backup applications connecting to icloud.com

Tuning notes: Map dest_host/remote_hostname to your network or DNS telemetry field. The /Applications exclusion hides legitimate apps but also malicious apps installed there; baseline signed third-party iCloud clients and tighten the exclusion by signing ID. Correlate with the iCloud account file or keychain detections on the same host and with iCloud-side session reviews.

• 🔒 CVE-2024-54471 NetAuthAgent MIG Service Abuse or Kass/ipsw MIG Tooling — Exploitation (KQL) · unlock with TL Creds
• 🔒 macOS Keychain Internet-Password and iCloud Account File Access by Non-Apple Process — Post-Exploitation (KQL) · unlock with TL Creds
• 🔒 iCloud API Access by Scripting Clients or Non-Apple Processes (Stolen Token Use) — C2 / Lateral Movement (KQL) · unlock with TL Creds
• 🔒 CVE-2024-54471 NetAuthAgent MIG Service Abuse or Kass/ipsw MIG Tooling — Exploitation (Sigma) · unlock with TL Creds
• 🔒 macOS Keychain Internet-Password and iCloud Account File Access by Non-Apple Process — Post-Exploitation (Sigma) · unlock with TL Creds
• 🔒 iCloud API Access by Scripting Clients or Non-Apple Processes (Stolen Token Use) — C2 / Lateral Movement (Sigma) · unlock with TL Creds
• 🔒 CVE-2024-54471 NetAuthAgent MIG Service Abuse or Kass/ipsw MIG Tooling — Exploitation (SPL) · unlock with TL Creds
• 🔒 macOS Keychain Internet-Password and iCloud Account File Access by Non-Apple Process — Post-Exploitation (SPL) · unlock with TL Creds

Indicators of compromise for NetAuthAgent credential leak

As of 2026-10-30, Threadlinqs Intelligence tracks 5 indicators of compromise for TL-2026-4835.

How NetAuthAgent credential leak works

Apple fixed it on 2024-10-28 with an entitlement check; the researcher states there is no evidence of malicious use.

NetAuthAgent is a macOS user-agent daemon that handles credentials for file servers (FTP, Samba, WebDAV). It exposes a Mach Interface Generator (MIG) server registered in the bootstrap namespace as com.apple.netauth.user.gui with base routine ID 40200. Before the fix, the server did not verify who sent a message. Routine 19 (message ID 40219) accepted a serialized property-list dictionary (keys Scheme, Host, AlternatePort, Path) and returned the matching username and password in out-of-line data descriptors, so any local application could use NetAuthAgent as a credential proxy for keychain items of class 'internet password' that NetAuthAgent is allowed to read.

The same primitive extends to iCloud. According to the researcher (Noah Gregory, published on the Objective-See Foundation blog on 2025-03-20), a keychain item present on essentially every macOS device holds the decryption key for an on-disk file containing iCloud account information (names, email addresses, aliases, enabled features and multiple long-lasting iCloud API tokens). Because NetAuthAgent could be made to return that key, an unprivileged local process could decrypt the file and use the tokens to reach contacts, calendars, Find My data (own devices and friends' locations, plus lock/erase/sound actions), iCloud key-value store data, iCloud backup metadata (including device serial numbers) and read-only CloudKit queries. The researcher notes that earlier work by Wojciech Regula (Securing.pl) described iCloud token exposure and its uses. In corporate settings the same primitive could expose SSO or file-server credentials usable for lateral movement.

The researcher used a Swift Mach-message research tool named Kass to build a MIG client for the service and to enumerate keychain items via SecItemCopyMatching with kSecClassInternetPassword. Vulnerable MIG servers can be located by searching Mach-O binaries for the NDR_record symbol (e.g. with the ipsw CLI). The fix makes NetAuthAgent read the sender's audit token from the kernel-appended message trailer, fetch the sender's entitlements, and refuse the message unless the entitlement com.apple.private.netauth.useragent.allow is true; AMFI constrains third-party apps from claiming restricted entitlements.

Apple shipped the fix in macOS Sequoia 15.1, Sonoma 14.7.1 and Ventura 13.7.1 on 2024-10-28 and added the CVE entry to its advisories on 2024-12-11 (impact: 'A malicious application may be able to leak a user's credentials'). NVD scores it CVSS 3.1 5.5 (MEDIUM), CWE-522. The CVE is not listed in CISA KEV, and the researcher states there is no evidence it was ever used or found by malicious actors. No network IOCs, malware samples or threat-actor attribution are associated with it.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1530 Data from Cloud Storage

Initial Access

T1078.004 Cloud Accounts

Credential Access

T1212 Exploitation for Credential Access; T1528 Steal Application Access Token; T1555.001 Keychain

lateral-movement

T1550.001 Application Access Token

Execution

T1559 Inter-Process Communication

Remediation for NetAuthAgent credential leak

Patches

• Apple added entitlement checks (com.apple.private.netauth.useragent.allow) in macOS Sequoia 15.1, Sonoma 14.7.1 and Ventura 13.7.1 (2024-10-28)

Immediate actions

• Update macOS to Sequoia 15.1, Sonoma 14.7.1, Ventura 13.7.1 or later
• Rotate file-server/SSO credentials and review iCloud sessions on Macs that ran unpatched builds with untrusted local software

Workarounds

• No vendor workaround documented; restrict execution of untrusted local applications until patched

Longer-term hardening

• Enable iCloud Advanced Data Protection where available
• Disable iCloud web access if unused
• Monitor for unexpected Mach IPC to com.apple.netauth.user.gui from non-Apple binaries

Affected and fixed versions

• Apple — macOS
  Vulnerable versions: Ventura < 13.7.1; Sonoma < 14.7.1; Sequoia < 15.1
  Fixed in: Ventura 13.7.1; Sonoma 14.7.1; Sequoia 15.1

Timeline of NetAuthAgent credential leak

• 2024-10-28 Apple releases macOS Sequoia 15.1, Sonoma 14.7.1 and Ventura 13.7.1 containing the NetAuthAgent entitlement-check fix
• 2024-12-11 Apple adds CVE-2024-54471 (NetAuth, credit locked-ioc-3) to the 15.1, 14.7.1 and 13.7.1 security content pages
• 2024-12-12 CVE-2024-54471 published in NVD with CVSS 3.1 base score 5.5 (MEDIUM) and CWE-522
• 2025-03-20 Write-up discussed on Hacker News (item 43425605)
• 2025-03-20 locked-ioc-3 publishes the full technical write-up on the Objective-See Foundation blog and wts.dev, including the iCloud token exposure chain
• 2026-06-17 NVD record last modified, adding a secondary CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:N/UI:R)

Sources cited for NetAuthAgent credential leak

• NVD - CVE-2024-54471 NVD (NIST) · Advisory · 2024-12-12
• Rapid7 vulnerability database: Apple OSX NetAuth CVE-2024-54471 Rapid7 · Advisory
• Leaking Passwords...and more on macOS (Objective-See, Noah Gregory) objective-see.org · Research · 2025-03-20
• Password leak write-up (Noah Gregory, wts.dev) wts.dev · Research · 2025-03-20
• About the security content of macOS Sequoia 15.1 Apple · Vendor report · 2024-12-11
• About the security content of macOS Sonoma 14.7.1 Apple · Vendor report · 2024-12-11
• About the security content of macOS Ventura 13.7.1 Apple · Vendor report · 2024-12-11
• Hacker News discussion of the Objective-See post news.ycombinator.com · News

More in vulnerability

• Microsoft Analysis: 78% of Exploited Vulnerabilities Enable System Takeover and Privilege Escalation
• Android November 2026 Security Bulletin: Over 200 Vulnerabilities Patched, Including Critical Framework RCE (CVE-2026-58868)
• Docker Sandboxes (sbx CLI) Symlink Vulnerability Lets AI Agents Read/Write Host Files Outside Sandbox (CVE-2026-103916)
• Reachy Mini AI Robot Unauthenticated HTTP RCE Chain (CVE-2026-96455, CVE-2026-96456, CVE-2026-55419, CVE-2026-62661, CVE-2026-53605)
• Barracuda critical flaws (CVE-2026-116606, CVE-2026-111560) allow root access to ESG, ADC, Message Archiver, WAF and Web Security Gateway devices