Topic starter
11/07/2026 8:26 pm
TL;DR: macOS in 2018 saw a sharp rise in RAT-based malware, trojanised apps, cryptojacking and phishing-led wallet theft, with Empyre used in several variants and approved or trusted channels abused to bypass built-in protections, according to SentinelOne. The pattern shows that platform trust, not just exploit sophistication, is the weak point.
Editorial analysis by NHI Mgmt Group, based on content published by SentinelOne: “A Review of Malware Affecting macOS in 2018”.
Key questions
Q: What fails first when a signed macOS app turns out to be malicious?
A: The first failure is trust in the distribution path, not necessarily code execution control.
Q: Why do macOS RATs and trojans increase privilege and lateral access risk?
A: They turn an endpoint infection into a reusable access path.
Q: How do security teams detect persistence on macOS endpoints?
A: Focus on new LaunchAgents, unexpected binaries in Application Support, and processes that reappear after termination.
Practitioner guidance
- Harden application provenance checks Require validation of software origin, signing context and expected runtime behaviour before allowing installation or execution in managed macOS estates.
- Monitor LaunchAgents and LoginItems Alert on new persistence entries, especially those created by utilities, updaters or archive-based installers that should not establish background execution.
- Restrict privilege escalation paths Review which user actions can elevate permissions on macOS and remove unnecessary admin rights from employees who do not need them.
Bottom line: The main lesson from this macOS malware year is that trusted software paths can be more dangerous than obvious exploits when attackers can hide behind normal execution cues.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:55 pm
Platform trust was the real attack surface in 2018 macOS malware. The article shows that signed software, trusted apps, user-approved utilities and expected installer workflows were all turned into delivery mechanisms. That means the weak point was not only exploitation. It was the assumption that trusted distribution paths are inherently safe. Practitioners should treat trust boundaries as security controls that need continuous verification.
A question worth separating out:
Q: What should organisations do when trusted channels are used to deliver macOS malware?
A: Treat the channel as compromised for governance purposes and raise controls around install approval, download handling and privilege elevation. When attackers can use app stores, signed packages or user trust to reach execution, the control response has to shift from simple malware blocking to stronger provenance checks and tighter runtime monitoring.
👉 Read our full editorial: macOS malware in 2018 exposed RAT and supply chain risks