Comment by hyperhello

Instead of replacing the executable, couldn’t it be wrapped and augmented, so it’s just running payload in the background with the original permissions and keychain access? It does seem pretty bad.