New Security Tools Target Growing macOS Threats

Two researchers, Obinna Igbe and Godwin Attigah, have developed Malet, a public dataset of macOS malware, and Katalina, an open source static analysis tool designed to process thousands of binaries per minute, to help defenders better identify macOS threats. At Black Hat Europe 2025 they will present their findings in a session titled “Silence on macOS: What 70K Binaries Reveal About the MacOS Malware Ecosystem,” with Malet reportedly containing 48,400 malicious and 22,907 benign Mach-O binaries.

Their work also notes that 96.1% of malicious samples are unsigned, highlighting enforcement gaps in Apple’s code-signing model. They have identified North Korean state-sponsored actors as being active in macOS malware, including signed binaries tied to a DPRK-linked APT that remained online for 760 days before Apple revoked it, and they warn that credential stealers are rising as a primary enterprise threat.

The researchers plan to release Katalina alongside Malet, and say the tools are platform-agnostic to help analysts work beyond macOS environments. Apple did not immediately respond to a request for comment, and the researchers say existing antivirus and EDR technologies are not reliably blocking these threats early enough.