Apple has made notable updates to macOS malware tools over the course of the last six months, according to updates tracked by Howard Oakley at Eclectic Lighting Company (via Ars Technica).
"In the last six months, macOS malware protection has changed more than it did over the previous seven years," writes Oakley in a blog post published this week. Malware detection on the Mac is now "fully pre-emptive" and as active as "many commercial anti-malware products."
Specifically, at around the time that macOS 12.3 Monterey was launched, Apple quietly introduced a new XProtect Remediator tool for its XProtect service that checks for malware in the background. XProtect Remediator more frequently looks for malware and fixes it if malware is detected.
Apple previously used the Malware Removal Tool (MRT) and XProtect, but XProtect was limited to checking apps and code against a list of known malware and MRT ran infrequently. Apple's new solution is more aggressive and offers more protection. Xproduct Remediator is available on Macs running macOS Monterey, macOS Big Sur, and macOS Catalina, but it is not available on Macs running older versions of macOS.
The new XProtect feature is updated regularly and it runs at least once per day, but sometimes even more frequently. For some malware checks, it runs as often as every hour or two, and it is able to identify a range of malware, such as Adload, DubRobber, Pirrit, SnowDrift, Trovi, and more.
Scans are most likely to take place when the Mac is awake but not in active use, and is primarily doing background tasks like backups and receiving email. Oakley says that the new malware protections represent a "big step forward" for those who are running the most recent versions of macOS, with more information available in Oakley's full blog post.
Top Rated Comments
Oh, and if you had read the article you’d know that Macs already had anti-malware built in. The point of the article is that it’s gotten better.
When protection is, effectively, built into the OS, you know that every developer will have had to deal with it.
When protection is one of a dozen, or more, products, you cannot realistically expect developers to have dealt with more than a small proportion.
Please can I have back the hours I have spent trying to identify why some software is not working on some machines - but is fine on others. Eventually finding that removal of anti-malware fixes it. But on the adjacent machine all is well with it installed.
(And removal of anti-malware software can be harder than getting rid of some actual malware.)