Apple uses a several techniques to ensuring as few of its users as possible are infected with malware.
While it is certainly true that malware isn’t as prolific on Macs as it is on PCs, this is quickly changing, as Apple achieve a higher share of the desktop and laptop market. In the past, Mac users have been protected by “security by minority”, as cybercriminals have not thought it was worth the effort to target macOS.
Apple will first prevent the launch and execution of malware, combing the App Store with Gatekeeper and Notarization. Notarization is a malware scanning service, and developers who want to distribute apps outside of the official App Store submit their apps for scanning, Apple scans the app for malware and if nothing is found, a ticket is issued. Developers can then staple this ticket to their app, so Gatekeeper can verify and launch the app. Apple can also revoke Notarization tickets for apps that have become malicious. macOS checks for revocation tickets on a regular basis, so that Gatekeeper has the latest information to be able to block to the launch of any such apps.
macOS includes a built-in antivirus software called XProtect, for the detection and removal of malware. It is in many ways similar to Windows Defender, included with Windows 8 and Windows 10, but XProtect is much more hidden and doesn’t have a visible user interface. XProtect uses YARA signatures, a tool which is used to detect malware, which is updated regularly by Apple. It is far from perfect, however, as in 2021 a new AdLoad variant slipped through XProtect. Adliad is a Trojan that has been targeting Macs since late 2017, and can harvest system information that is later sent to remote servers controlled by its operators. Phil Stokes, a cybersecurity researcher found that 150 out of 220 man-in-the-middle (MiTM) web proxies went undetected by XProtect. Nonetheless, XProtect does a decent job at protecting your Mac against malware; it checks for malicious content whenever an app is first launched, when an app has been changed in the file system, and when XProtect signatures are updated. When malware is detected by XProtect, the software is blocked and the user is notified, and given the option of moving the software to the trash.
Mac users still need to be vigilant against malware, however, as Macs are certainly not immune and the threat of Mac malware is growing.
