Suspicious Spotlight Importer (.mdimporter) Creation

ravi vaghasiya@ravivaghasiya

•updated Aug 1, 2025•2•0•43

Detects the creation of a Spotlight importer bundle (.mdimporter) in a user's Library directory. This is a key step in the Sploitlight TCC bypass technique (CVE-2025-31199), where an attacker places a malicious importer to be executed with elevated privileges by the mds_stores process, allowing unauthorized access to TCC-protected data.