Shift Left and Hunt Deep: Announcing Automated Exposure Discovery Engines for macOS XPC and Oracle Cloud IAM

As enterprise infrastructure expands across hybrid environments—ranging from the local macOS endpoints used by developers to massive distributed environments in the cloud—the attack surface grows increasingly complex. Security teams are frequently overwhelmed by a flood of raw, uncontextualized alerts.

To stay ahead of modern threat actors, organizations are shifting from reactive vulnerability scanning to proactive exposure hunting. Today, we are highlighting advanced exposure hunting engines engineered to uncover hidden architectural flaws within macOS XPC applications and Oracle Cloud Infrastructure (OCI) IAM environments. 

The XPC Hunter open-source tool will be presented and made available to download at BlackHat USA 2026 Arsenal on August 6th, and the OCI exposure discovery open-source tools will be introduced and made available at DEF CON 2026. Join the waitlist for preliminary updates on the tools’ availability and download links.   

1. XPC Hunter: Automated macOS XPC Attack Surface Discovery

Enterprise security teams rely on an implicit assumption: that only a vendor’s own signed software can talk to the privileged background processes — XPC services — that ship with macOS applications. In practice, many of those services establish trust the wrong way: they authorize a caller by its code‑signing identity alone (team ID / CDHash). FAInd my XPC shows this is bypassable end‑to‑end from an unprivileged account. By priming the AMFI code‑signing cache and swapping a sealed NIB resource that the daemon’s dynamic code‑signature check never re‑validates, an attacker runs their own code inside a trusted, signed application and inherits its identity — without modifying any signed executable. Against any privileged XPC service that trusts callers solely by code‑signing identity, a non‑root, non‑admin user can then invoke privileged methods with no further authentication — demonstrated as unauthenticated root code execution in shipping endpoint‑security software.

FAInd my XPC is an automated framework for discovering macOS XPC attack surface and validating privilege escalation end‑to‑end. Unlike scanners that only flag candidate interfaces, it proves exploitability: it injects into a trusted application, reverse‑engineers the reachable privileged daemons, and issues a real privileged call. It combines static binary analysis (otool / __objc_methtype protocol and method‑signature extraction, Mach‑service discovery), dynamic injection and runtime enumeration (AMFI cache priming + NIB‑injected JXA payloads), LLM‑driven reverse engineering with Claude that recovers each daemon’s exposed methods, argument signatures, protocols, and connection‑acceptance rule, and an outcome verifier that confirms the concrete effect of a fired call.

This open‑source tool automates the manual overhead of reverse‑engineering XPC protocols, method signatures, and connection‑acceptance logic. It targets a vulnerability class, not a single bug: macOS applications that expose privileged (often root) XPC services and authorize callers only by code‑signing identity — a check that can be satisfied from userland, without modifying any signed executable, because dynamic code‑signature validation verifies the trusted process’s code identity but not the swapped interface resource it loads. Services that additionally enforce per‑action authorization or launch‑constraint/identifier pinning are not exploitable this way; FAInd my XPC distinguishes the two automatically. 

FAInd my XPC pipeline:

• Inventory — Enumerates installed apps, daemons, and privileged helpers, flagging those that host a root process and ship an injectable NIB/UI resource. Output: ranked target list with root‑host and injectable indicators.
• Inject & Prove — Primes the AMFI/CDHash code‑signing cache and swaps a sealed NIB resource in a trusted signed app, then confirms the injected payload actually executes. Output: injection‑confirmed flag and payload artifacts per app.
• Recon (Attack Surface) — From inside the trusted process, determines which privileged root XPC services the injected client can actually reach. Output: reachable‑service map.
• Reverse (AI Agent) — An AI agent (Claude) drives the reverse engineering: it decompiles and analyzes each reachable daemon to recover every exposed method, its argument/reply signatures, its protocol, and the code‑signing acceptance predicate that gates the service. Output: exported‑interface map and per‑service acceptance rule.
• Fire & Verify — Issues a real NSXPC call to a privileged method; an AI verification agent then inspects the resulting filesystem/process/log evidence to confirm the concrete outcome (e.g., root code execution) rather than assuming success. Output: verified exploit result and evidence report. 

Catch the debut of FAInd my XPC at the BlackHat Arsenal in August or sign up to download the open-source tool in order to go from a baseline blind spot to definitive verification of an exposure within minutes.

2. Offensive OCI Tooling: Identity & Network Exposure Discovery in Oracle Cloud Infrastructure IAM

Moving from local endpoints to core cloud infrastructure, Identity and Access Management (IAM) serves as the primary security perimeter. In Oracle Cloud Infrastructure (OCI), securing this perimeter requires understanding how identities intersect with real-world network reachability.

Oracle Cloud Infrastructure provides a unique modeling for IAM that includes a policy language, compartment hierarchy, dynamic groups, verb-based permissions, and instance/resource principals. The IAM model provides attackers with specific privilege escalation paths that can be exploited to compromise critical assets.

To overcome complexity and equip security teams with automated offensive tooling to assess and repair OCI IAM configuration, XM Cyber researchers built two dedicated open-source engines.

1. pOliCI parses OCI IAM policy statements, expands them against Oracle’s permission reference data, and computes effective permissions per principal. This open source tool is used to identify over-privileged users and understand what a compromised identity can actually do.
2. CLI Signing Helper is a fork of the OCI CLI (command line) management interface enhanced with offensive capabilities such as instance principal authentication for off-instance exploitation.

A dedicated Offensive OCI workshop that explains how OCI IAM works and how attackers can exploit it, and shares the automated tools will take place at DEF CON 2026. Make sure you sign up for the workshop or sign up to download the tools in order to proactively protect your Cloud environment from OCI privilege escalations.