---
title: "Prevent Spotlight Importer Exploits | Security Cookbook"
description: "Lock down Spotlight importer directories and the Apple Intelligence database to prevent Sploitlight-style TCC bypasses and sensitive data exfiltration."
doc_version: "1"
last_updated: "2026-05-22"
canonical: "https://northpole.security/cookbook/prevent-spotlight-exploit"
---
[Back](https://northpole.security/cookbook)

### Idea

Spotlight importers have been used as a persistence trick for a while. Microsoft recently disclosed a variant of this vulnerability they called "Sploitlight" (CVE-2025-31199), which exploits Spotlight importer plugins to bypass Apple's Transparency, Consent, and Control (TCC) protections. This lets attackers exfiltrate sensitive data from protected directories without user consent. While Apple patched this vulnerability in macOS 15.4, macOS 26 remained vulnerable.

Spotlight importers are plugins (.mdimporter bundles) that help macOS index specific file types for search. They run in sandboxed mdworker processes with privileged access to files they're indexing. The problem is that attackers can create or modify unsigned importer bundles, drop them into user-writable directories like ~/Library/Spotlight, and abuse their privileged access to read files normally protected by TCC. This allows attackers to read things like the Pictures and Apple Intelligence databases, which contain geolocation data, facial recognition metadata, and iCloud-linked device information. Since these databases are synced across devices via iCloud, compromising a single device could leak all of your data.

With Workshop and Santa's file access rules, simply lock down Spotlight directories to prevent access. You can also lock down sensitive files like the Apple Intelligence Database so that any future variants still can't get at these crown jewel files.

### Solutions

File AccessLock Down Spotlight Directories

Prevent unauthorized modification of Spotlight importer directories

Paths

-   •
    
    /Users/\*/Library/Spotlight/
    
-   •
    
    /Library/Spotlight/
    

Policy

BLOCKLIST

Access Type

write

Custom Message

Spotlight importer modification is not allowed

File AccessProtect Apple Intelligence Database

Restrict access to Apple Intelligence and sensitive system databases

Paths

-   •
    
    /Users/\*/Library/Apple Intelligence/
    
-   •
    
    /Users/\*/Pictures/
    

Policy

ALLOWLIST

Processes

-   •
    
    Signing ID:platform:com.apple.photoanalysisd
    
-   •
    
    Signing ID:platform:com.apple.Photos
    

Custom Message

This database is protected from unauthorized access

### Mitre Attack

Tactics

[Persistence](https://attack.mitre.org/tactics/TA0003/)[Privilege Escalation](https://attack.mitre.org/tactics/TA0004/)[Stealth](https://attack.mitre.org/tactics/TA0005/)[Execution](https://attack.mitre.org/tactics/TA0002/)

Techniques

[T1546: Event Triggered Execution](https://attack.mitre.org/techniques/T1546/)[T1574: Hijack Execution Flow](https://attack.mitre.org/techniques/T1574/)[T1068: Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068/)

### Tags

spotlighttcc-bypassprivilege-escalation

### Deployment Notes

The first rule blocks writes to Spotlight directories, preventing attackers from dropping malicious importer bundles. The second rule protects sensitive databases that contain valuable user data.

These rules work together to prevent Sploitlight-style attacks even on unpatched systems.

### False Positive Guidance

Very few legitimate applications need to install Spotlight importers. If your organization uses custom Spotlight importers, add exceptions for those specific applications by their signing ID and team ID.

### Resources

[Microsoft: Sploitlight VulnerabilityTake a look](https://www.microsoft.com/en-us/security/blog/2025/07/28/sploitlight-analyzing-a-spotlight-based-macos-tcc-vulnerability/)[The Evil Bit: Spotlight PersistenceTake a look](https://theevilbit.github.io/beyond/beyond_0011/)

## Sitemap

- [Home](https://northpole.security/index.md)
- [Workshop](https://northpole.security/workshop.md)
- [Santa](https://northpole.security/santa.md)
- [Features](https://northpole.security/features.md)
- [Cookbook](https://northpole.security/cookbook.md)
- [Docs](https://northpole.security/docs.md)
- [Blog](https://northpole.security/blog.md)
- [Glossary](https://northpole.security/glossary.md)
- [About](https://northpole.security/about.md)
- [Contact](https://northpole.security/contact.md)