Mac Detections by The Numbers

The talk opens with Malwarebytes detection totals for 2021, which stayed fairly steady across the year, and shows where those detections were seen. The United States dominates, mirroring the company's customer base, while Asia is thinly represented, so regional figures carry that bias. Potentially unwanted programs and adware, led by bundled installers from one vendor, make up most of the volume.

The middle of the talk covers individual samples. A generic suspicious-behavior rule caught many launch agents and daemons with random names, often containing curl-to-bash pipelines or base64-encoded Python, and that activity declined over the year. Detection geography varied: XCSSET and OSAMiner leaned toward the Middle East and Asia, while ElectroRAT and Electrum Stealer had very few sightings. Silver Sparrow's empty ._insu file inflated its counts, and excluding it shrank the spike considerably. XcodeSpy, WildPython and XLoader showed little or no real-world detection, which may reflect targeting outside the customer base.

The closing takeaway is that regional spread often matches the region where an actor operates, though visibility gaps make that hard to confirm. The speaker stresses that adware and unwanted programs remain the everyday threat to Mac users, far outweighing nation-state tooling in volume.