Unmasking Mac Malware – Strategies to Face a Growing Threat

Apple devices have long had a reputation for being inherently more secure than other operating systems. Even Apple’s infamous “Buy a Mac” advertising campaign emphasized Mac security and poked fun at some of Windows’ security features.

When this campaign launched in 2006, this statement was probably true. Macs were used more often as personal devices, making them a less attractive target for cybercriminals attacking corporate targets.

However, as Apple carved out a larger niche in the workplace, the status quo has changed and Apple devices are now a lucrative target for cybercriminals. We’re seeing a more diverse range of threats targeting the Apple ecosystem, so organizations need to be ready to defend themselves.

Growing threats in the Mac ecosystem

In the past, the Mac malware landscape consisted primarily of adware, which typically displays or downloads unwanted material but is largely free from more insidious threats. This meant that security teams could feel comfortable with less stringent processes because more dangerous and difficult malware was unlikely to occur.

However, in recent years, cybercrime groups have increased their efforts to find vulnerabilities and create malware that exploits iOS or macOS. Jamf’s latest annual threat landscape survey detected 300 malware families designed for macOS and 21 families newly created in 2023.

Not only the number of malware families has increased, but also the type of threats observed. While adware remains a major concern, accounting for 36.77% of all Mac malware detections, we are now seeing a higher percentage of threats such as Trojans, ransomware, and Advanced Persistent Threats (APTs).

This means that organizations operating in the Apple ecosystem now have to contend with malware that poses a much greater risk than adware. For example, Trojans are specifically designed to bypass traditional defenses by masquerading as legitimate software, while encryption attacks can be highly destructive and costly to companies.

Suzan Sakarya

Senior Manager, EMEIA Security Strategy at Jamf.

The disturbing state of cyber hygiene

In addition to creating new malware, cybercriminals continue to develop and refine their social engineering techniques. This means organizations need to focus strongly on cyber hygiene, both for technical processes and users. Unfortunately, we found that companies often did not achieve the required results.

Phishing remains a serious threat, and attackers are particularly keen to exploit mobile users. We found that phishing attempts on mobile devices are approximately 50% more successful than on desktop computers, indicating a vulnerability that extends beyond traditional computing devices.

We also found that mobile devices are very vulnerable to security vulnerabilities. A disturbing 40% of mobile users in our study were using devices with known vulnerabilities that had not been patched, showing that mobile phones are often not managed and patched to the same extent as desktop computers.

The importance of regular updates and stringent security protocols cannot be overstated. This oversight exposes organizations to significant cybersecurity risk because legacy software often lacks the necessary protection against emerging threats. For example, Pegasus spyware tends to exploit zero-day vulnerabilities in both new and older devices.

Moreover, critical security settings such as encryption and lock screens are often disabled, making it easier for attackers to access sensitive data once they compromise a system.

This is especially important as the number and variety of malware continues to grow and more attackers focus on Mac computers. Organizations that previously managed to avoid Apple’s lax security processes for their machines may soon find their luck running out.

Best practice for mitigating Mac malware

Organizations must take a more proactive security stance to stay ahead of the growing threat of Mac malware and other cyber threat trends. There are many different, interconnected paths you can take here.

At a basic level, endpoint detection and response (EDR) tools are essential to maintaining situational awareness of the security posture of all endpoints. These endpoint protection tools detect potential threats in real time and provide automated responses to identified threats, thus enabling continuous monitoring and immediate action on possible security breaches. Organizations should ensure that all devices are equally covered by EDR, which includes Windows, Mac and any other operating systems present in the corporate environment.

Businesses also need to focus on the basics of safety hygiene. This includes routine software updates to patch security vulnerabilities and training employees on best practices such as the use of passwords and settings such as encryption. Companies can consider backing up by implementing advanced device management tools to monitor and manage device configurations to ensure they are compliant with company policy.

Data encryption also plays a key role in securing information. This is often a weak point. We found that 36% of devices had disabled the key FileVault encryption feature. By encrypting data both in transit and at rest, organizations ensure that even if data is intercepted, it remains unreadable to unauthorized persons.

Finally, companies should strive to adopt a Zero Trust model. This security framework works on the principle that no entity on or off the network is automatically trusted. Each access attempt must be rigorously verified, which significantly reduces the risk of hacking and unauthorized access. This can provide an effective defense against all forms of infringement occurring on the network.

Looking to the future

As Mac devices become more common in the workplace, ensuring comprehensive security plans have never been more important. Any organization that continues to rely on a lighter Mac security system that is geared towards annoying solutions like adware will be in for a nasty surprise when faced with new, more dangerous threats. Companies need to ensure that they not only have a multi-layered strategy in place, but that it is applied evenly to all devices that connect to the corporate environment.

We present the best solution for managing mobile devices.

This article was produced by TechRadarPro’s Expert Insights channel, where we showcase the best and brightest minds in today’s technology industry. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in cooperation, you can find more information here: https://www.techradar.com/news/submit-your-story-to-techradar-pro