---
id: 4322
title: "Intego X9: Why your macOS antivirus should not trust PIDs"
source_domain: blog.quarkslab.com
source_url: "https://blog.quarkslab.com/intego_lpe_macos_2.html"
published_at: "2026-02-25 23:00"
tags: ["vulnerability-research", "privilege-escalation", "ghidra", "macos", "race-condition", "frida", "intego", "xpc"]
phying_url: "https://phying.com/item/4322"
lang: en
---

# Intego X9: Why your macOS antivirus should not trust PIDs

## Summary

Part two of Quarkslab's Intego series: combining Ghidra static analysis with Frida tracing to show how a PID reuse race can bypass XPC authentication checks on privileged macOS services.

## Intelligence Metadata

- **Sources:** blog.quarkslab.com
- **Published:** 2026-02-25 23:00
- **Original:** https://blog.quarkslab.com/intego_lpe_macos_2.html
- **Phying News:** https://phying.com/item/4322