- Microsoft finds a macOS safety error that could allow threat actors to extract confidential data from Apple Intelligence
- “Sploitlight” revolts around Spotlight
- It was solved in macOS Sequoia 15.4, so users should now update
Microsoft has revealed details of a macOS security vulnerability that allowed threat actors to steal confidential information of the Apple Intelligence AI tool.
In a blog post, Microsoft said it found an error that avoids the mechanisms of transparency, consent and control (TCC) found in macOS devices. TCC is a security and privacy framework that restricts access to user confidential data and system characteristics.
The error, tracked as CVE-2025-31199, could allow computer pirates to access files in the download folder, as well as caches used by Apple Intelligence. Microsoft called the vulnerability “Sploitlight” since it abuses the foci accessories, but says it is more dangerous than previous TCC derivations such as HM-Surf or Powerdir.
“Severe implications”
“The implications of this vulnerability are more serious due to their ability to extract and filter confidential information in Cache for Apple’s intelligence, such as precise geolocation data, photo and videos metadata, face and person recognition data, search history and user preferences, and more,” Microsoft explained.
“These risks are complicated and increased even more due to the remote linking capacity between ICloud accounts, which means that an attacker with access to the macOS device of a user could also exploit vulnerability to determine the remote information of other devices linked to the same ICloud account.”
Spotlight accessories are used to index files for macOS search. Although these supplements are executed in a sandboxed environment, they still have privileged access to scanned files, which means that attackers can modify accessories metadata to go to specific types of files.
When registering the content of the file during indexation, attackers can exfilter the data without the need for TCC permits.
Apple says that the fault was solved in March 2025, through patches for macOS sequoia 15.4. In NVD, it is described that the patch provides “improved data writing.” Microsoft said that Endpoint’s defender now detects “suspicious” facilities .MDIMPORTER and unusual indexation of sensitive directories.
Through Bleepingcomputer
