The macOS Big Sur 11.4 update fixes a major security vulnerability that let hackers spy on users

In May 2021, Apple released macOS Big Sur 11.4, an update that closed a zero-day vulnerability: attackers could secretly see users’ screens without asking for permission, as legitimate apps have to. Threatpost covered the case in detail at the time.

The vulnerability, recorded in the specialist references as CVE-2021-30713, was already being used by the XCSSET malware to spy on users of Apple products. The bug let hackers see the screen while users were working in various apps or taking part in video conferences.

The flaw was discovered by the security firm Jamf, and Apple closed it in the macOS Big Sur 11.4 update. What’s more, the exploit could be used to gain access to users’ data and to record the screen, again without any permissions.

The malicious app looked through the apps already installed for one that had permission to take screenshots, and then piggybacked on it.

Zoom is a very good example of an app that has permission to see the screen. The malware compromised the app and could then capture the user’s screen while the video conferencing app was in use.

Around the same time, Apple released several unscheduled security updates for vulnerabilities discovered in iOS, macOS and watchOS.

Backup as a Service: tell me more →

How secure are Apple devices running macOS?

From a security standpoint, macOS was designed according to fairly strict rules. The system is built on the Unix philosophy, and over the years Apple has added several layers of protection.

The main security features of macOS:

• apps ask for permission before using sensitive resources, such as the webcam, the microphone or screen recording (for example, Zoom asks for the right to use the built-in webcam);
• system changes and the installation of many apps require an administrator account password, so anyone who doesn’t know it can’t change the Mac’s important settings;
• Gatekeeper checks downloaded apps, and XProtect, the anti-malware protection built into macOS, blocks known malicious programs.

There are fewer viruses for Mac than for Windows, but not zero. The XCSSET case shows exactly that: the malware got around the permissions system itself. In recent years, more and more programs that steal passwords and data from Macs have appeared, so company Macs also need current updates and centrally managed protection. See also the article Does Mac OS X need antivirus protection?

What does this mean for company Macs in 2026?

It means the macOS version matters just as much as it does with Windows: only recent versions receive security patches. Big Sur no longer receives regular security updates. In October 2026, Apple published security updates for macOS Golden Gate 27, macOS Tahoe 26 and macOS Sequoia 15; the full list is on Apple’s security updates page.

What to check on your company’s Macs:

1. The macOS version. You’ll find it under Apple menu > About This Mac. A Mac that can no longer move to an up-to-date version should be replaced on a planned schedule. macOS Golden Gate 27 runs only on Macs with Apple processors (M1 or newer), while Macs with Intel processors stay on older versions, which receive updates only for a limited time.
2. Automatic updates. In System Settings > General > Software Update, turn on automatic installation of security updates.
3. Disk encryption. FileVault protects your data if the laptop is lost or stolen.
4. Backup. Time Machine on an external disk, plus an off-site copy, for example through Backup as a Service.
5. Central management. In a company, Macs are enrolled in a mobile device management (MDM) solution, so security settings are applied the same way on all of them.

RezolvIT can manage any kind of IT infrastructure, including one made up entirely of Apple products. If you’d like us to check your company’s Macs and other computers, request a free IT audit or contact us.