The latest discovery was published Friday by Mac antivirus provider Intego, which disclosed malware dubbed OSX/CrescentCore that's available through Google search results and other mainstream channels. Usually the same day that an article comes out about a piece of malware, Apple has already blocked it.June was a busy month for Mac malware with the active circulation of at least six threats, several of which were able to bypass security protections Apple has built into modern versions of its macOS. That's not the fault of any third party AV, but the shortcoming of the APIs Apple has provided for implementing antivirus software.Īpple has a fast track record of responding to in the wild threats.

In fact right now on M1 to install kernel extensions you have to downgrade your secure boot, which in my opinion puts your system into a worse security state than without AV. I agree with the others that with DNS-level and ad blocker level hardening to try to crack down on malvertising, you should be fine without a third party AV software.Ĭurrently third party AVs rely heavily on custom hooks via kernel extensions (kexts), and Apple is trying to deprecate those.

Furthermore, Apple's GateKeeper is cloud-connected with both certificate and application level blocking, much like SmartScreen or SONAR. Note that in macOS Big Sur, the so called built-in antivirus (XProtect and Malware Removal Tool) are significantly revamped, and use YARA rules for signatures instead of dumbly hardcoded hashes.

Best mac malware protection in 2019