Apple Approved Malware on Macs? The Truth

Yes, Apple has approved malware for Macs, but the reality is more nuanced than the headline. Apple’s notarization process—the automated scan that checks apps for known malicious code before allowing them to run—has been bypassed by real malware multiple times. This article explains how that happens, what it means for your safety, and what you can do about it.

What Is Apple’s App Approval Process?

Apple uses two main layers of protection for macOS apps:

• App Review – For apps distributed through the Mac App Store, human reviewers check the app’s functionality and content. This is a manual process and is not foolproof.
• Notarization – For apps downloaded from the internet (outside the App Store), Apple runs an automated scan that checks the app for known malware. If the scan passes, the app is “notarizedâ€� and can run without a warning.

Notarization is not a human review. It’s a fast, automated check that looks for signatures of known malware. It does not test the app’s behavior or look for novel threats. This is a key distinction: Apple approves apps that look safe, not apps that are safe.

How Malware Got “Approved�

Malware authors have found ways to get their malicious apps notarized. The most common method is to use a stolen or purchased Apple Developer account. With a valid developer ID, an attacker can submit their app to Apple’s notarization service. If the app’s code doesn’t contain known malware signatures, Apple will approve it—even if the app is designed to do something malicious once it’s running.

For example, in 2021, researchers found a family of malware called XCSSET that had been notarized. The malware was hidden inside a legitimate-looking app, and it could steal passwords, take screenshots, and even record the screen. Apple revoked the certificate after it was discovered, but the malware had already been distributed for months.

Another example is Shlayer, a trojan that disguises itself as a Flash Player installer. It has been found with valid notarization on several occasions. Shlayer is one of the most common Mac threats, and it’s often delivered via fake browser updates.

Why Does This Keep Happening?

There are several reasons why notarization is not a perfect safety net:

• Automated scanning only catches known threats. If a malware sample is new or slightly modified, the scanner may not recognize it.
• Malware can be “cleanâ€� at scan time. Some malware is designed to download the malicious payload after it’s been approved. The initial app is benign, so it passes the scan, but then it fetches malicious code from a remote server.
• Developer accounts are valuable. Stolen or fake developer credentials are sold on the dark web, making it easy for attackers to get a valid signing identity.
• Apple revokes certificates after the fact. But by the time Apple discovers the malware, it may have already infected thousands of Macs.

What Does “Approved� Actually Mean?

When an app is notarized, macOS shows a message like “Apple checked it for malicious software and none was detected.� That sounds reassuring, but it only means that the specific version of the app passed the automated scan at the time it was submitted. It does not mean:

• The app is free of privacy-invasive behavior.
• The app will not change after installation.
• The app is from a reputable developer.
• The app is safe to use.

Notarization is a baseline check, not a seal of approval. It’s designed to stop the most obvious malware, not to guarantee safety.

How to Stay Safe

Since Apple’s approval is not a guarantee, you need to take additional steps to protect your Mac:

1. Download only from the Mac App Store or the developer’s official website. Avoid third-party download sites, which are often used to distribute malware.
2. Check the developer’s name. In the notarization warning, macOS shows the developer’s name. If it looks suspicious or you don’t recognize it, don’t install the app.
3. Read the app’s permissions. When an app asks for access to your contacts, camera, or microphone, ask yourself if it really needs that access.
4. Keep macOS and your apps up to date. Apple regularly updates its malware definitions, and updates often include security patches.
5. Use a reputable antivirus app. While built-in protections help, a third-party antivirus can catch threats that Apple’s scanner misses.
6. Be wary of “free� apps that seem too good to be true. Malware is often bundled with cracked software or “free� versions of paid apps.

Common Misconceptions

One common misconception is that Macs are immune to malware. That has never been true, and as Macs have become more popular, they’ve become a bigger target. Another misconception is that Apple’s approval means the app is safe. As we’ve seen, that’s not the case.

Another misconception is that you only get malware from downloading “sketchy� files. In reality, even legitimate-looking apps can be compromised. For example, in 2020, the popular app Malwarebytes was itself briefly infected with malware when its update server was hacked. This shows that even trusted apps can be a vector.

Frequently Asked Questions

Is it true that Apple approved malware on Macs?

Yes. Several malware families have been notarized by Apple’s automated scan, including XCSSET and Shlayer. This happens because notarization only checks for known malware signatures, and attackers can use valid developer accounts to pass the scan.

Does notarization mean an app is safe?

No. Notarization only means that the app passed an automated scan at the time it was submitted. It does not mean the app is free of malicious behavior, and it does not mean the app won’t change after installation.

Can malware be notarized after it’s already on my Mac?

Notarization happens before an app is distributed. If you already have malware on your Mac, it was notarized before you downloaded it. After it’s installed, the malware can update itself, and those updates are not notarized.

How do I know if an app is safe to download?

There is no 100% guarantee, but you can reduce risk by downloading from the Mac App Store or the developer’s official website, checking the developer’s name, reading reviews, and keeping your system updated.

Should I use antivirus software on my Mac?

It can help. While macOS has built-in protections, antivirus software can catch threats that Apple’s scanner misses. Choose a reputable product and keep it updated.

What should I do if I think I have malware?

First, disconnect from the internet. Then, run a scan with a trusted antivirus tool. You can also check your login items and browser extensions for anything suspicious. If you’re unsure, consider taking your Mac to an Apple Store or a professional repair service.

Related

• Music Gifts for Commuters & Vinyl Fans
• Synth Riders DLC Without Full Game: Can You?
• What to Do After Device Is Rooted? Next Steps