Mac Malware Detections Dropped 38% in 2020, Most Still Adware

Antivirus software developer Malwarebytes today shared its 2021 State of Malware Report, which found that malware threat detections on Macs fell a total of 38 percent in 2020.

In 2019 Malwarebytes detected a total of 120,855,305 threats, which dropped to 75,285,427 threats in 2020. Consumer threats were down 40 percent, but as businesses operated remotely and shifted to online work, threat detections for business users grew 31 percent.

mac malware 2020
There was a drop in detections of Adware and potentially unwanted programs (PUPs), but Malwarebytes says that malware, which includes backdoors, data stealers, and cryptocurrency stealers/miners, increased by more than 61 percent.

That number sounds high, but malware still only accounted for 1.5 percent of all threat detections on the Mac, with the rest still coming from Adware and PUPs.

Potentially unwanted software represented more than 76 percent of detection in 2020, while Adware represented approximately 22 percent. These are overall numbers, and the breakdowns varied somewhat by country, but most Malwarebytes users are in the United States. Business machines saw a bit more malware and adware, with less unwanted software.

Of malware found on Macs, the top 10 malware families accounted for more than 99 percent of the total, with more than 80 percent detected due to suspicious behaviors. OSX.FakeFileOpener, malicious apps designed to open files, accounted for the second highest number of detections.

top mac malware 2020
Malwarebytes says that the most unusual Malware detected on Macs in 2020 was ThiefQuest, which spread through installers found on torrent sites. When infected, Macs would start to have files encrypted, with the malware providing ransom instructions.

These instructions went nowhere, though, and didn't provide a legitimate contact for removing the encryption. Instead, the ransomware was a cover for something more malicious.

Upon further investigation, we learned that the ransomware activity was really a cover for massive data exfiltration, including MS Office and Apple iWork documents, PDF files, images, cryptocurrency wallets, and more. This kind of malware, known in the Windows world as a "wiper," had never before been seen on Macs.

Even more interesting, the malware would inject malicious code into executable files found in the Users folder, such as components of Google Software Update, in a virus- like manner, another rarity in the Mac world. The combination of these features made ThiefQuest not only the most unusual Mac malware in 2020, but perhaps the most unusual Mac malware ever.

Sophisticated adware techniques were also spotted on Macs in 2020, including phishing for admin passwords, using synthetic clicks to automate browser extension installations, modifying the sudoers file to maintain root permissions indefinitely, and manually editing the TCC database to give the adware more system access.

On Macs, Malwarebytes says that the "business model of choice for most criminals" remains Adware, with trojans, worms, spyware, and RiskWareTools being more common on Windows machines. Still, malware is an increasing Mac problem and it's something that Mac users should be aware of.

Malwarebytes' full report can be read on the Malwarebytes website.

Top Rated Comments

steve09090 Avatar
18 weeks ago
From the report.

Windows detections - 111,014,261 (down 12%)
Mac detections - 75,285,427 (down 38%)
Android detections show it getting much "nastier" and detections are increasing exponentially. (No overall numbers)
iOS detections - nothing reported Other than "it’s possible as some vulnerabilities exist"

That walled garden is looking quite lush...
Score: 16 Votes (Like | Disagree)
ArPe Avatar
18 weeks ago

what's the best solution to tackle malware or other harmful thinks on Mac? Any ideas? Any software I need to buy?
Stay away from torrent sites ?

Don’t install pirate apps ?

Stay away from illegal streaming sites ?

Stay away from crypto sites ?

Don’t click on shortened URLs sent or posted by anon accounts on social media ?

Don’t install more apps than you really need ?

Only use signed apps from well known developers ?
Score: 12 Votes (Like | Disagree)
ian87w Avatar
18 weeks ago
Sometimes I have to wonder people who have enough money to buy a Mac, but cheapen out on the software or content that they have to rely on pirate torrents.

I mean it’s understandable for a person who can barely afford $400 Windows laptop to take the piracy route. But I have a hard time feeling any sympathy for someone capable of affording $1k-$2k Mac yet being a cheapskate on software and content. With so many free apps available, and many apps being more affordable on mobile, piracy imo is more of personal choice nowadays.
Score: 10 Votes (Like | Disagree)
wanha Avatar
18 weeks ago

what's the best solution to tackle malware or other harmful thinks on Mac? Any ideas? Any software I need to buy?
An Apple engineer who was helping me with an unusual issue last year recommended Malwarebytes.

He said it is Apple support's go-to malware app in instances where one is needed (which, fortunately, is quite rare).
Score: 4 Votes (Like | Disagree)
LV426 Avatar
18 weeks ago

what's the best solution to tackle malware or other harmful thinks on Mac? Any ideas? Any software I need to buy?
The best solution is to install software from the App Store. If you do this, it is very unlikely you will have problems in the first place.

If you don't, be very careful indeed where you get your software. Don't go to torrent sites or such to get software. You're just asking for trouble if you do that. There are reputable software vendors who don't use the App Store, but you will need to take special measures on your machine to allow such programs to be installed. The default is to only allow App Store programs to be installed.

There are, of course, plenty of dodgy websites that will drop, or try to drop, installers onto your computer. A classic ruse is "Your Flash player is out of date. Click here to update". If you happen to get one of those installers, and try to run it, you'll get a system popup asking for your Mac login details before it allows the installation to proceed. You should, therefore, be very wary indeed if you ever see something like that, and cancel the installation.
Score: 4 Votes (Like | Disagree)
lkrupp Avatar
18 weeks ago

Often the person buying the computer is not the same person buying software. For example, children being issued Macs from school or given one by parents will sometimes have no way of obtaining some content or software so they resort to piracy. Additionally, some subscriptions are quite expensive. Adobe can charge hundred of dollars yearly, which is not a small amount even if you could afford Mac hardware.
Sounds to me like you are condoning piracy. If you can’t afford it it’s okay to steal it? Unfortunately that is the mentality that has been instilled in the culture over the years.
Score: 4 Votes (Like | Disagree)

Top Stories

YouTube Picture in Picture Feature

YouTube Says iOS Picture-in-Picture Coming to All US Users

Friday June 18, 2021 9:41 am PDT by
After a long wait, YouTube for iOS is officially gaining picture-in-picture support, allowing all users, non-premium and premium subscribers, to close the YouTube app and continue watching their video in a small pop-up window. In a statement to MacRumors, YouTube says that picture-in-picture is currently rolling out to all premium subscribers on iOS and that a larger rollout to all US iOS...
Top Stories 63 Feature

Top Stories: Beats Studio Buds Announced, Apple Watch Series 7 Rumors, and More

Saturday June 19, 2021 6:00 am PDT by
The Apple news cycle started to move beyond WWDC this week, but that doesn't mean there still wasn't a lot to talk about, led by the official debut of the much-leaked Beats Studio Buds that might give us a hint of what to expect for the second-generation AirPods Pro. With no hardware announcements at WWDC, we also took a look at when we might finally see the long-rumored redesigned MacBook...
ios wifi settings

iOS Bug Causes Specific Network Name to Disable Wi-Fi on iPhones

Sunday June 20, 2021 4:15 am PDT by
A wireless network naming bug has been discovered in iOS that effectively disables an iPhone's ability to connect to Wi-Fi. Security researcher Carl Schou found that after joining a Wi-Fi network with the name "%p%s%s%s%s%n" his iPhone's Wi-Fi functionality was left "permanently disabled." Changing a hotspot's SSID did nothing to correct the problem, with even a reboot failing to make a...
maxresdefault

Video: 20 Annoyances Apple Fixed in iOS 15 and macOS Monterey

Friday June 18, 2021 11:36 am PDT by
With iOS 15 and macOS Monterey, Apple is adding several quality of life improvements, which are designed to address some of the complaints that people have had with these operating systems for years now. Subscribe to the MacRumors YouTube channel for more videos. In our latest YouTube video, we're highlighting some of our favorite "fix" features that address long-running problems in iOS and...
16 inch macbook pro m2 render

When Can We Expect the Redesigned MacBook Pros Now?

Wednesday June 16, 2021 7:11 am PDT by
With no sign of redesigned MacBook Pro models at this year's WWDC, when can customers expect the much-anticipated new models to launch? A number of reports, including investor notes from Morgan Stanley and Wedbush analysts, claimed that new MacBook Pro models would be coming during this year's WWDC. This did not happen, much to the disappointment of MacBook Pro fans, who have been...
space gray magic accessories trio

Apple Stops Selling Magic Accessories in Space Gray

Friday June 18, 2021 9:16 am PDT by
Apple this week stopped selling its Magic Keyboard with Numeric Keypad, Magic Mouse 2, and Magic Trackpad 2 accessories for the Mac in a Space Gray color, around three months after discontinuing the iMac Pro, which also came in Space Gray. Last month, Apple listed the Space Gray accessories as available while supplies last, and the company has now removed the product pages from its website...
m1 v intel thumb

Intel Processor Market Share May Fall to New Low Next Year Due to Apple Silicon

Friday June 18, 2021 2:06 am PDT by
Intel may see its market share fall to a new low next year, in large part thanks to Apple's decision to move away from using Intel processors in its Mac computers and instead use Apple silicon. Apple announced last year that it would embark on a two-year-long journey to transition all of its Mac computers, both desktops, and laptops, to use its own in-house processors. Apple is expected to...
3nm apple silicon feature

Apple Supplier TSMC Readies 3nm Chip Production for Second Half of 2022

Friday June 18, 2021 6:59 am PDT by
Apple supplier TSMC is preparing to produce 3nm chips in the second half of 2022, and in the coming months, the supplier will begin production of 4nm chips, according to a new report from DigiTimes. Apple had previously booked the initial capacity of TSMC's 4nm chip production for future Macs and more recently ordered TSMC to begin production of the A15 chip for the upcoming iPhone 13,...
2021 back t0 school

Apple Launches 2021 Back to School Promotion: Free AirPods With Eligible Mac or iPad Purchase

Thursday June 17, 2021 4:56 am PDT by
Apple today launched its seasonal back-to-school sale for the upcoming school year in the United States and Canada, offering students free AirPods alongside purchases of select Macs and iPad models. Similar to last year's promotion, this year's offer includes free AirPods alongside the purchase of a MacBook Air, MacBook Pro, the new 24-inch iMac, the Mac Pro, Mac mini, and the new M1-powered ...
applecare lower prices

Apple Lowers Prices of AppleCare+ Plans for M1 MacBook Air and MacBook Pro

Thursday June 17, 2021 7:33 am PDT by
Apple today lowered the prices of AppleCare+ plans for MacBook Air and 13-inch MacBook Pro models equipped with the M1 chip. Coverage offered by the plans, as well as accidental damage fees, appear to remain unchanged. In the United States, AppleCare+ for the MacBook Air now costs $199, down from $249. The new price applies to both M1 and Intel-based MacBook Air models, although Apple no...