Beyond Static Labels: A Behavioral Framework for macOS Grayware Classification

Grayware on macOS, including adware and potentially unwanted programs, has long been treated as a low-priority nuisance. The speaker argues that newer families now borrow malware habits such as persistence, obfuscation, encrypted payloads and covert data collection, yet public datasets still file them under generic labels that say little about operational risk. The talk opens by distinguishing legitimate software, grayware and malware, and by looking at macOS trust mechanisms like notarization, consent prompts and configuration profiles that grayware can exploit.

The core of the talk is a behavioral rubric. Each sample is scored from 0 to 3 across five categories: deception, persistence, monetization, user consent and payload activity. Grayware typically reaches three or more of these categories. The speaker walks through a notarized sample that works as a residential proxy node and scores 15 of 15, showing how file, launch agent, process and network telemetry feed each score. Scored results can be condensed into a descriptive label, such as a downloader with deception and silent install traits, and thresholds can route high-scoring samples to faster triage.

A case study of the Adload family from 2016 to 2025 shows the drift in behavior. A 2016 sample scored 6, while a 2025 sample scored 13, with escalation across all five categories. The speaker presents the approach as a complement to traditional malware classification rather than a replacement, and as a foundation for adaptive detection, risk scoring and intelligence work. Automating the scoring is named as future work.