Evolution of the Mac Threat Landscape

The talk traces how Mac threats have changed since the first widespread virus, Elk Cloner, which hit Apple II machines in 1982 through floppy disks and was largely a prank. Early examples such as Seven Dust added encryption and file deletion, while Thief Quest in 2020 infected binaries in user folders by prepending malicious code to them.

The talk then compares older behaviors with current ones. Malware now relies on obfuscated shell scripts, often base64 strings piped into a shell from a launch agent, along with packers and custom string hiding. Compiled AppleScript and Go, Rust or Electron apps make analysis harder. Backdoors have become near universal, from early Trojans in 2004 to custom Objective-C or Swift code. Financial threats began with the 2007 DNS changer case, where the FBI kept a rogue server running for years so victims would not lose connectivity. Today's stealers and fake wallet apps target cryptocurrency, while potentially unwanted programs, scam antivirus apps and subscription traps in the App Store are common. Adware and pups now account for most detections the speaker's company sees.

The closing part looks at what practitioners should take away. Signing and notarization changes mean many modern samples are unsigned and rely on users bypassing Gatekeeper prompts. Apple is limited in acting against pups without proof of wrongdoing, so third-party vendors take that role. Malvertising is the main delivery path today. Defenders should watch behaviors such as scripts being decoded and executed, rather than relying on static code signatures.