Patrick Wardle (@patrickwardle), the founder of the Objective-See Foundation, disclosed a vulnerability in Meta’s Muse Mac client on September 21st that he says can let malware on a user’s Mac reach other devices connected to the same Muse account, including an iPhone.
Wardle, a former NASA and NSA employee who has spent years analyzing macOS malware, posted a three-part demonstration showing a compromised Muse session remotely obtaining an iPhone’s location in Barcelona and initiating a Bluetooth Low Energy scan on the phone. He said the mobile tasks ran invisibly through the Muse client.
Wardle published a proof of concept called not-a-mused for what he describes as a local zero-day in the Muse macOS app. The attack requires an adversary or malicious program to already be able to execute code under the Mac user’s account. It is not a drive-by remote compromise of an otherwise untouched Mac.
The Muse client exposes an undocumented setting named endo_voyager_dictation_endpoint, according to Wardle’s repository. An unprivileged local process can change that setting and redirect dictated prompts to an attacker-controlled server. Wardle says that interception can expose dictated audio and prompts, inject instructions into Muse and capture Muse authentication material.
The proof of concept then queries Muse’s device inventory through an account API. Each connected device advertises the commands it supports, along with a device identifier and whether it is online. Wardle’s code can select an online device and direct Muse to invoke an available command on it.
An attacker must first run code on the Mac. Once that happens, Wardle’s research indicates that the blast radius can include the user’s agent account and other connected devices.