Once the attacker has both Full Disk Access and the login password, the malware can move from simple execution to broad collection. It can read browser data, decrypt keychain material, steal cloud and developer credentials, capture files and screenshots, and install persistence through startup files and LaunchAgents. At that point, the compromise extends beyond one endpoint and becomes an identity and access risk across connected systems.
What the attacker can do after Full Disk Access and the login password
Once a ClickFix-style chain reaches both Full Disk Access and a valid macOS login password, the compromise stops being a narrow execution problem and becomes a broad local trust problem. At that point, the malware can inspect sensitive files, browser state, app data, and user material that normally stays protected by the operating system’s file and privacy boundaries.
The practical shift is that the attacker can move from “running code” to “collecting value.” That includes browser sessions, saved credentials, developer tooling, cloud access material, and other data that gives them access to additional systems beyond the original Mac. NHIMG’s Ultimate Guide to NHIs is useful background here because the impact often spreads into credentials and tokens that are really access assets, not just local files.
With those two permissions, the endpoint can also become a persistence host. Startup items, LaunchAgents, and other login-time mechanisms let the malware survive reboots and keep reusing the same local trust context until the user notices and removes it.
Why this becomes an identity and access problem, not just a malware problem
The important issue is not only theft from the Mac itself. If the attacker can read password managers, browser cookies, cloud CLI profiles, SSH material, API keys, or developer tokens, they may inherit the user’s reach into SaaS platforms, source control, build systems, and internal admin tools. Shai Hulud npm malware campaign shows how exposed secrets can quickly become a supply-chain problem when stolen material is reused elsewhere.
Full Disk Access matters because it bypasses many of macOS’s normal privacy restrictions. The login password matters because it unlocks the user’s protected data and often enables decryption or access to stores that are otherwise less useful to an attacker. CircleCI Breach is a strong real-world example of endpoint compromise turning into session-token theft and downstream access to customer secrets.
That is why the right mental model is “credential and session theft plus persistence,” not “one infected laptop.” Once the attacker can reuse legitimate access material, detection gets harder because their actions may look like normal user activity until unusual exfiltration or login patterns appear.
Risk and Threat Considerations
The main risk is blast radius. A single compromised Mac can expose local secrets, then become a bridge into cloud services, code repositories, ticketing systems, and identity-linked platforms that trust the stolen material. The threat is especially severe when the user handles development, operations, finance, or admin workflows, because those roles often have broad reusable access.
Failure mechanism: The malware abuses granted local trust to harvest browser stores, keychain-linked material, files, screenshots, and startup persistence, then reuses stolen credentials or sessions to pivot into connected services.
Impact: You can lose confidentiality, session integrity, and account control at the same time, and the compromise may continue after the Mac is cleaned if passwords, tokens, certificates, or browser sessions are not revoked.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Secrets and Credential Management | The attack steals reusable access material from the Mac. |
| NHI-02 — Privileged Access and Least Privilege | Stolen credentials can carry excessive access beyond the endpoint. | |
| NHI-05 — Discovery and Inventory | You need to know which accounts and tokens were reachable from the device. | |
| Recommendation — Rotate exposed secrets and revoke any compromised credential or token. Reduce standing privilege and scope access to the minimum required. Inventory exposed credentials, sessions, and account dependencies promptly. | ||
| CIS Controls v8 | 6 — Access Control Management | Compromised local trust can be reused to access other systems. |
| 4 — Secure Configuration of Enterprise Assets and Software | The malware relies on endpoint permissions and persistence mechanisms. | |
| 8 — Audit Log Management | Investigations depend on identifying token use and suspicious reuse. | |
| Recommendation — Restrict and revoke access paths tied to the compromised user. Harden macOS privacy, startup, and persistence settings on managed devices. Preserve logs that show account reuse, token activity, and persistence. | ||
| MITRE ATT&CK | T1005 — Data from Local System | The chain collects browser, keychain, and file data from the endpoint. |
| T1547 — Boot or Logon Autostart Execution | Persistence commonly uses login-time startup mechanisms on macOS. | |
| T1555 — Credentials from Password Stores | The attacker can harvest saved passwords and browser-stored secrets. | |
| Recommendation — Hunt for local data collection and mass file access after initial compromise. Check LaunchAgents and other logon persistence locations during response. Prioritise password-store and browser-secret theft indicators in triage. | ||
Practitioner Guidance
What to verify: Treat any case with both Full Disk Access and a login password as a credential-theft incident, not a simple malware cleanup. Verify whether browser sessions, password manager data, SSH material, developer tokens, cloud CLI profiles, and synced account sessions were present on the device at the time of compromise.
Decision rule: If the affected user had access to production systems, source code, or administrative consoles, rotate and revoke credentials before assuming the endpoint is safe. Device reimage alone is not enough if stolen access material can still authenticate elsewhere.
Practitioner takeaway: The key question is not whether the malware ran, but whether it obtained durable access material that can be reused off-device, because that is what turns a local compromise into an enterprise identity event.
Related resources from NHI Mgmt Group
- What happens when Kinsing-style malware gets a foothold in a container without runtime controls?
- Why do macOS malware campaigns often become an identity and access problem?
- How should organisations respond when malware gains persistent macOS access?
- What breaks when destructive malware gets past initial access controls?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
