There is, in fact, a quarantine bit, but that metadata isn't very hard to change for a process that has enough access to a file to run it. `xattr -rc` and you'r

There is, in fact, a quarantine bit, but that metadata isn't very hard to change for a process that has enough access to a file to run it. `xattr -rc` and you're in. Disclaimer: I've not even begun to really dig into this, beyond reading a few assorted pages like this one: https://www.sentinelone.com/blog/macos-malware-researchers-how-to-bypass-xprotect-on-catalina/ https://www.sentinelone.com/blog/macos-malware-researchers-h... and this one: https://blog.malwarebytes.com/101/2019/02/macos-protect-malware/ https://blog.malwarebytes.com/101/2019/02/macos-protect-malw...