Mac Malware Detections Dropped 38% in 2020, Most Still Adware

Antivirus software developer Malwarebytes today shared its 2021 State of Malware Report, which found that malware threat detections on Macs fell a total of 38 percent in 2020.

In 2019 Malwarebytes detected a total of 120,855,305 threats, which dropped to 75,285,427 threats in 2020. Consumer threats were down 40 percent, but as businesses operated remotely and shifted to online work, threat detections for business users grew 31 percent.

mac malware 2020
There was a drop in detections of Adware and potentially unwanted programs (PUPs), but Malwarebytes says that malware, which includes backdoors, data stealers, and cryptocurrency stealers/miners, increased by more than 61 percent.

That number sounds high, but malware still only accounted for 1.5 percent of all threat detections on the Mac, with the rest still coming from Adware and PUPs.

Potentially unwanted software represented more than 76 percent of detection in 2020, while Adware represented approximately 22 percent. These are overall numbers, and the breakdowns varied somewhat by country, but most Malwarebytes users are in the United States. Business machines saw a bit more malware and adware, with less unwanted software.

Of malware found on Macs, the top 10 malware families accounted for more than 99 percent of the total, with more than 80 percent detected due to suspicious behaviors. OSX.FakeFileOpener, malicious apps designed to open files, accounted for the second highest number of detections.

top mac malware 2020
Malwarebytes says that the most unusual Malware detected on Macs in 2020 was ThiefQuest, which spread through installers found on torrent sites. When infected, Macs would start to have files encrypted, with the malware providing ransom instructions.

These instructions went nowhere, though, and didn't provide a legitimate contact for removing the encryption. Instead, the ransomware was a cover for something more malicious.

Upon further investigation, we learned that the ransomware activity was really a cover for massive data exfiltration, including MS Office and Apple iWork documents, PDF files, images, cryptocurrency wallets, and more. This kind of malware, known in the Windows world as a "wiper," had never before been seen on Macs.

Even more interesting, the malware would inject malicious code into executable files found in the Users folder, such as components of Google Software Update, in a virus- like manner, another rarity in the Mac world. The combination of these features made ThiefQuest not only the most unusual Mac malware in 2020, but perhaps the most unusual Mac malware ever.

Sophisticated adware techniques were also spotted on Macs in 2020, including phishing for admin passwords, using synthetic clicks to automate browser extension installations, modifying the sudoers file to maintain root permissions indefinitely, and manually editing the TCC database to give the adware more system access.

On Macs, Malwarebytes says that the "business model of choice for most criminals" remains Adware, with trojans, worms, spyware, and RiskWareTools being more common on Windows machines. Still, malware is an increasing Mac problem and it's something that Mac users should be aware of.

Malwarebytes' full report can be read on the Malwarebytes website.

Top Rated Comments

steve09090 Avatar
26 months ago
From the report.

Windows detections - 111,014,261 (down 12%)
Mac detections - 75,285,427 (down 38%)
Android detections show it getting much "nastier" and detections are increasing exponentially. (No overall numbers)
iOS detections - nothing reported Other than "it’s possible as some vulnerabilities exist"

That walled garden is looking quite lush...
Score: 16 Votes (Like | Disagree)
ArPe Avatar
26 months ago

what's the best solution to tackle malware or other harmful thinks on Mac? Any ideas? Any software I need to buy?
Stay away from torrent sites ?

Don’t install pirate apps ?

Stay away from illegal streaming sites ?

Stay away from crypto sites ?

Don’t click on shortened URLs sent or posted by anon accounts on social media ?

Don’t install more apps than you really need ?

Only use signed apps from well known developers ?
Score: 12 Votes (Like | Disagree)
ian87w Avatar
26 months ago
Sometimes I have to wonder people who have enough money to buy a Mac, but cheapen out on the software or content that they have to rely on pirate torrents.

I mean it’s understandable for a person who can barely afford $400 Windows laptop to take the piracy route. But I have a hard time feeling any sympathy for someone capable of affording $1k-$2k Mac yet being a cheapskate on software and content. With so many free apps available, and many apps being more affordable on mobile, piracy imo is more of personal choice nowadays.
Score: 10 Votes (Like | Disagree)
wanha Avatar
26 months ago

what's the best solution to tackle malware or other harmful thinks on Mac? Any ideas? Any software I need to buy?
An Apple engineer who was helping me with an unusual issue last year recommended Malwarebytes.

He said it is Apple support's go-to malware app in instances where one is needed (which, fortunately, is quite rare).
Score: 4 Votes (Like | Disagree)
LV426 Avatar
26 months ago

what's the best solution to tackle malware or other harmful thinks on Mac? Any ideas? Any software I need to buy?
The best solution is to install software from the App Store. If you do this, it is very unlikely you will have problems in the first place.

If you don't, be very careful indeed where you get your software. Don't go to torrent sites or such to get software. You're just asking for trouble if you do that. There are reputable software vendors who don't use the App Store, but you will need to take special measures on your machine to allow such programs to be installed. The default is to only allow App Store programs to be installed.

There are, of course, plenty of dodgy websites that will drop, or try to drop, installers onto your computer. A classic ruse is "Your Flash player is out of date. Click here to update". If you happen to get one of those installers, and try to run it, you'll get a system popup asking for your Mac login details before it allows the installation to proceed. You should, therefore, be very wary indeed if you ever see something like that, and cancel the installation.
Score: 4 Votes (Like | Disagree)
lkrupp Avatar
26 months ago

Often the person buying the computer is not the same person buying software. For example, children being issued Macs from school or given one by parents will sometimes have no way of obtaining some content or software so they resort to piracy. Additionally, some subscriptions are quite expensive. Adobe can charge hundred of dollars yearly, which is not a small amount even if you could afford Mac hardware.
Sounds to me like you are condoning piracy. If you can’t afford it it’s okay to steal it? Unfortunately that is the mentality that has been instilled in the culture over the years.
Score: 4 Votes (Like | Disagree)

Popular Stories

iOS 16

iOS 16.3 Now Available for Your iPhone With These 4 New Features

Friday February 3, 2023 1:13 pm PST by
Apple released iOS 16.3 in late January following nearly six weeks of beta testing. The software update is available for the iPhone 8 and newer, and while it is a relatively minor update, it still includes a handful of new features, changes, and bug fixes. Below, we've recapped new features in iOS 16.3, including support for physical security keys as a two-factor authentication option for...
HomePod 2 White and Midnight Feature Purple Blue

Apple Explains Why HomePod Was Released Again, Wi-Fi 4 Limitation, and More

Thursday February 2, 2023 7:57 am PST by
Apple's VP of hardware engineering Matthew Costello and product marketing employee Alice Chan recently spoke with Men's Journal and TechCrunch about the new second-generation HomePod in wide-ranging interviews about the smart speaker. Apple discontinued the original full-size HomePod in March 2021 after multiple reports indicated that sales of the speaker were lackluster, but Chan told Men's ...
Apple Silicon Teal Feature

The Next Big Apple Silicon Device May Not Be a Mac or iPad

Wednesday February 1, 2023 3:57 am PST by
Apple's next device with an Apple silicon chip may not be a Mac or an iPad, but rather an advanced external display, according to recent reports. The display, which is rumored to arrive this year, is expected to sit somewhere between the $1,599 Studio Display and the $4,999 Pro Display XDR – but more exact information about the device's positioning and price point is as yet unknown. While ...
iOS 16

Apple Preparing iOS 16.3.1 Update for iPhone as Wait for iOS 16.4 Beta Continues

Thursday February 2, 2023 6:41 am PST by
Apple appears to be preparing an iOS 16.3.1 update for the iPhone, based on evidence of the software in our website's analytics logs this week. It's unclear when the update will be released, but it will likely be available at some point in February. The same logs have accurately foreshadowed the release of several previous updates, including iOS 16.0.3 and iOS 16.1.1 most recently, so they...
General iOS 16 Feature Yellow

Five New iOS Features Coming to Your iPhone Later This Year

Tuesday January 31, 2023 11:58 am PST by
Apple has previously announced several upcoming iOS features that are expected to be added to the iPhone this year. Some of the features could be introduced with iOS 16.4, which should enter beta testing soon, while others will arrive later in the year. Below, we have recapped five new iOS features that are expected to launch in 2023, such as an Apple Pay Later financing option for purchases ...
Apple Pay Later Quick Green Feature

Apple Pay Later Launching 'Soon'

Thursday February 2, 2023 2:10 pm PST by
The Apple Pay Later service that Apple has in the works is set to launch "soon," Apple CEO Tim Cook told CNBC ahead of today's earnings call for the first fiscal quarter of 2023. Cook said that Apple employees are beta testing the Apple Pay Later feature, which will help Apple boost services revenue. "It will be launching soon," Cook said. Apple Pay Later was first previewed at the...
webkit vs chromium feature

Google Working on Browser for iOS That Would Break Apple's App Store Rules

Saturday February 4, 2023 1:30 am PST by
Google's Chromium developers are working on an experimental web browser for iOS that would break Apple's browser engine restrictions, The Register reports. The experimental browser, which is being actively pursued by developers, uses Google's Blink engine. Yet if Google attempted to release it on the App Store, it would not pass Apple's App Review process. Apple's App Store rules dictate...