I have installed Parallels Desktop on my Macbook M1.

During installation process, Parallels asked my to authenticate with an administrator account. I can see with kextstat command that Parallels has installed kernel modules.

Let's suppose one of this modules contains a malware. I want to understand what this malware can do on my computer:

  • If my harddrive is protected with filevault: The malware will only see my current user files ? Or can it read the whole disk (other users accounts)
  • If my TCC configuration restricts Parallels application (Documents folder file access disallowed): Do you think the kernel modules will bypass the TCC restriction ?


  • If you have a genuine version of Parallels Desktop, there is no reason that it harbors malware.
    – user415185
    Commented Nov 11, 2021 at 8:54
  • ↑ This is why we have application signing, so we know what we can trust.
    – Tetsujin
    Commented Nov 11, 2021 at 9:47
  • I do not trust any software editor, including Parallels. But this application is signed, so do you think Apple made an audit of this application ? Thanks
    – Bob5421
    Commented Nov 11, 2021 at 10:05
  • @Bob5421 Apple do not audit anything except in the AppStore and even then not enough to say it has not got malware.
    – mmmmmm
    Commented Nov 11, 2021 at 10:08
  • They do not audit anything but they can look if kernel modules are trying to bypass TCC ?
    – Bob5421
    Commented Nov 11, 2021 at 10:15

1 Answer 1


Modifications to the kernel used to be game over and still are close to game over if you can be compelled or tricked to load arbitrary malware as system or kernel extensions. Game over means you can’t depend on any security working to protect data or tamper with any process running.

It really depends which specific code you load, though. There are layers of security being built so that a network VPN extension might be prevented from bypassing sandbox or reading files. As Apple rolls out these newer more secure designs, and code you install uses the more secure and limited API/SDK potential bugs and malware might be more contained than in the past.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .