{"code":"var Component=(()=>{var p=Object.create;var s=Object.defineProperty;var g=Object.getOwnPropertyDescriptor;var k=Object.getOwnPropertyNames;var m=Object.getPrototypeOf,u=Object.prototype.hasOwnProperty;var y=(n,i)=>()=>(i||n((i={exports:{}}).exports,i),i.exports),f=(n,i)=>{for(var l in i)s(n,l,{get:i[l],enumerable:!0})},a=(n,i,l,t)=>{if(i&&typeof i==\"object\"||typeof i==\"function\")for(let r of k(i))!u.call(n,r)&&r!==l&&s(n,r,{get:()=>i[r],enumerable:!(t=g(i,r))||t.enumerable});return n};var C=(n,i,l)=>(l=n!=null?p(m(n)):{},a(i||!n||!n.__esModule?s(l,\"default\",{value:n,enumerable:!0}):l,n)),v=n=>a(s({},\"__esModule\",{value:!0}),n);var c=y((w,h)=>{h.exports=_jsx_runtime});var b={};f(b,{default:()=>o});var e=C(c());function d(n){let i={a:\"a\",code:\"code\",em:\"em\",h2:\"h2\",h3:\"h3\",img:\"img\",input:\"input\",li:\"li\",ol:\"ol\",p:\"p\",pre:\"pre\",span:\"span\",strong:\"strong\",table:\"table\",tbody:\"tbody\",td:\"td\",th:\"th\",thead:\"thead\",tr:\"tr\",ul:\"ul\",...n.components};return(0,e.jsxs)(e.Fragment,{children:[(0,e.jsx)(i.p,{children:\"The Mac malware landscape has evolved dramatically in early 2026. New threats like SimpleStealth (the first confirmed AI-assisted Mac malware), GlassWorm's VSCode extension attacks, and an alarming rise in Apple-notarized malware are challenging the long-held belief that Macs are inherently safe. This comprehensive guide covers the latest threats and provides actionable protection strategies.\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.img,{alt:\"Mac Security Threat\",src:\"/images/blog/mac-malware-threats-simplestealth-glassworm-2026/macsync-stealer-hero.webp\",width:\"1280\",height:\"720\"})}),`\n`,(0,e.jsx)(i.h2,{id:\"the-current-mac-threat-landscape\",children:\"The Current Mac Threat Landscape\"}),`\n`,(0,e.jsx)(i.h3,{id:\"why-mac-malware-is-increasing\",children:\"Why Mac Malware Is Increasing\"}),`\n`,(0,e.jsx)(i.p,{children:\"The growth in Mac malware can be attributed to several factors:\"}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"1. Market Share Growth:\"}),`\nMac market share has increased significantly, making it a more attractive target for attackers. More users mean more potential victims.`]}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"2. Cryptocurrency Adoption:\"}),`\nMany Mac users hold cryptocurrency, making credential-stealing malware highly profitable.`]}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"3. Developer Targeting:\"}),`\nMac's dominance in software development makes developers high-value targets. Stealing developer credentials can lead to supply chain attacks.`]}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"4. AI-Assisted Development:\"}),`\nMalware authors are now using AI tools to generate code, lowering the barrier to creating sophisticated threats.`]}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"5. Notarization Bypass:\"}),`\nAttackers have found ways to pass Apple's notarization process, making malware appear legitimate.`]}),`\n`,(0,e.jsx)(i.h3,{id:\"2026-threat-statistics\",children:\"2026 Threat Statistics\"}),`\n`,(0,e.jsxs)(i.table,{children:[(0,e.jsx)(i.thead,{children:(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.th,{children:\"Metric\"}),(0,e.jsx)(i.th,{children:\"2025\"}),(0,e.jsx)(i.th,{children:\"2026 (YTD)\"}),(0,e.jsx)(i.th,{children:\"Trend\"})]})}),(0,e.jsxs)(i.tbody,{children:[(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"New Mac Malware Families\"}),(0,e.jsx)(i.td,{children:\"48\"}),(0,e.jsx)(i.td,{children:\"12 (projected 52+)\"}),(0,e.jsx)(i.td,{children:\"Increasing\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Info-Stealer Variants\"}),(0,e.jsx)(i.td,{children:\"23\"}),(0,e.jsx)(i.td,{children:\"8 (projected 35+)\"}),(0,e.jsx)(i.td,{children:\"Increasing\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Notarized Malware\"}),(0,e.jsx)(i.td,{children:\"5\"}),(0,e.jsx)(i.td,{children:\"3\"}),(0,e.jsx)(i.td,{children:\"Concerning\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Zero-Day Exploits\"}),(0,e.jsx)(i.td,{children:\"9\"}),(0,e.jsx)(i.td,{children:\"2\"}),(0,e.jsx)(i.td,{children:\"Similar\"})]})]})]}),`\n`,(0,e.jsx)(i.h2,{id:\"simplestealth-first-ai-assisted-mac-malware\",children:\"SimpleStealth: First AI-Assisted Mac Malware\"}),`\n`,(0,e.jsx)(i.h3,{id:\"discovery\",children:\"Discovery\"}),`\n`,(0,e.jsx)(i.p,{children:\"On January 9, 2026, security firm Mosyle identified SimpleStealth as one of the first confirmed Mac malware samples containing AI-generated code. This marks a significant evolution in the malware development landscape.\"}),`\n`,(0,e.jsx)(i.h3,{id:\"how-it-works\",children:\"How It Works\"}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Distribution Method:\"}),`\nSimpleStealth is distributed through a fake website impersonating Grok AI, Elon Musk's AI chatbot. Users searching for Grok download what they believe is the legitimate application.`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Technical Characteristics:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Contains code patterns consistent with AI generation\"}),`\n`,(0,e.jsx)(i.li,{children:\"Employs advanced obfuscation techniques\"}),`\n`,(0,e.jsx)(i.li,{children:\"Targets browser credentials and cookies\"}),`\n`,(0,e.jsx)(i.li,{children:\"Attempts to access cryptocurrency wallets\"}),`\n`,(0,e.jsx)(i.li,{children:\"Evades traditional antivirus detection\"}),`\n`]}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"AI-Generated Elements:\"}),`\nSecurity researchers identified several indicators of AI involvement:`]}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Consistent coding style uncommon in human-written malware\"}),`\n`,(0,e.jsx)(i.li,{children:\"Sophisticated but formulaic obfuscation\"}),`\n`,(0,e.jsx)(i.li,{children:\"Comments and structure suggesting AI assistance\"}),`\n`,(0,e.jsx)(i.li,{children:\"Rapid iteration between variants\"}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"detection-status\",children:\"Detection Status\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"At discovery, SimpleStealth was \",(0,e.jsx)(i.strong,{children:\"undetected by all major antivirus engines\"}),\". This highlights the challenge AI-assisted malware poses to traditional signature-based detection.\"]}),`\n`,(0,e.jsx)(i.h3,{id:\"protection-against-simplestealth\",children:\"Protection Against SimpleStealth\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Immediate Actions:\"})}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Only download Grok from official sources (grok.x.ai)\"}),`\n`,(0,e.jsx)(i.li,{children:\"Verify application signatures before installation\"}),`\n`,(0,e.jsx)(i.li,{children:\"Use reputable antivirus with behavioral detection\"}),`\n`,(0,e.jsx)(i.li,{children:\"Monitor browser credential access\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Verify Application Source:\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# Check code signature\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"codesign\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -dv\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" --verbose=4\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /Applications/[AppName].app\"})]}),`\n`,(0,e.jsx)(i.span,{className:\"line\"}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# Verify notarization\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"spctl\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -a\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -v\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /Applications/[AppName].app\"})]})]})})}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.img,{alt:\"macOS Security Warning\",src:\"/images/blog/mac-malware-threats-simplestealth-glassworm-2026/gatekeeper-security-prompt.webp\",width:\"744\",height:\"808\"})}),`\n`,(0,e.jsx)(i.h2,{id:\"glassworm-vscode-extension-attack-campaign\",children:\"GlassWorm: VSCode Extension Attack Campaign\"}),`\n`,(0,e.jsx)(i.h3,{id:\"overview\",children:\"Overview\"}),`\n`,(0,e.jsx)(i.p,{children:\"GlassWorm is a sophisticated malware campaign targeting macOS developers through malicious VSCode and OpenVSX extensions. First detected in late 2025, Wave 4 of this campaign is currently active in January 2026.\"}),`\n`,(0,e.jsx)(i.h3,{id:\"attack-vector\",children:\"Attack Vector\"}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Compromised Extensions:\"}),`\nThree malicious extensions were identified with over `,(0,e.jsx)(i.strong,{children:\"50,000 combined downloads\"}),\":\"]}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:'One extension masquerading as \"Prettier Pro\"'}),`\n`,(0,e.jsx)(i.li,{children:'Extensions offering \"productivity enhancements\"'}),`\n`,(0,e.jsx)(i.li,{children:\"Themes with hidden malicious payloads\"}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"capabilities\",children:\"Capabilities\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Credential Theft:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Steals macOS Keychain passwords\"}),`\n`,(0,e.jsx)(i.li,{children:\"Extracts browser cookies and saved passwords\"}),`\n`,(0,e.jsx)(i.li,{children:\"Captures SSH keys and certificates\"}),`\n`,(0,e.jsx)(i.li,{children:\"Accesses stored API tokens\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Cryptocurrency Targeting:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Detects hardware wallet applications (Ledger Live, Trezor Suite)\"}),`\n`,(0,e.jsx)(i.li,{children:\"Replaces legitimate crypto apps with trojanized versions\"}),`\n`,(0,e.jsx)(i.li,{children:\"Targets 50+ browser-based crypto extensions\"}),`\n`,(0,e.jsx)(i.li,{children:\"Monitors clipboard for wallet addresses\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Supply Chain Risk:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Compromises developer machines\"}),`\n`,(0,e.jsx)(i.li,{children:\"Could potentially inject malicious code into developed software\"}),`\n`,(0,e.jsx)(i.li,{children:\"Access to code signing certificates\"}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"affected-extensions\",children:\"Affected Extensions\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Indicators of Compromise (IOCs):\"})}),`\n`,(0,e.jsxs)(i.table,{children:[(0,e.jsx)(i.thead,{children:(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.th,{children:\"Extension Name\"}),(0,e.jsx)(i.th,{children:\"Publisher\"}),(0,e.jsx)(i.th,{children:\"Downloads\"}),(0,e.jsx)(i.th,{children:\"Status\"})]})}),(0,e.jsxs)(i.tbody,{children:[(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Prettier Pro+\"}),(0,e.jsx)(i.td,{children:\"[Redacted]\"}),(0,e.jsx)(i.td,{children:\"28,000+\"}),(0,e.jsx)(i.td,{children:\"Removed\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Theme Enhancer\"}),(0,e.jsx)(i.td,{children:\"[Redacted]\"}),(0,e.jsx)(i.td,{children:\"15,000+\"}),(0,e.jsx)(i.td,{children:\"Removed\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Code Helper AI\"}),(0,e.jsx)(i.td,{children:\"[Redacted]\"}),(0,e.jsx)(i.td,{children:\"9,000+\"}),(0,e.jsx)(i.td,{children:\"Removed\"})]})]})]}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Note:\"}),\" Extension names change frequently. Always verify publishers and reviews before installation.\"]}),`\n`,(0,e.jsx)(i.h3,{id:\"detection-and-removal\",children:\"Detection and Removal\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Check Installed Extensions:\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# List VSCode extensions\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"code\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" --list-extensions\"})]}),`\n`,(0,e.jsx)(i.span,{className:\"line\"}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# Check for suspicious extensions\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"ls\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -la\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" ~/.vscode/extensions/\"})]})]})})}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Manual Inspection:\"})}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Open VSCode\"}),`\n`,(0,e.jsx)(i.li,{children:\"Go to Extensions (Cmd + Shift + X)\"}),`\n`,(0,e.jsx)(i.li,{children:\"Review installed extensions\"}),`\n`,(0,e.jsx)(i.li,{children:\"Remove any you don't recognize\"}),`\n`,(0,e.jsx)(i.li,{children:\"Verify remaining extensions against official sources\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"System-Wide Check:\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# Check for unauthorized changes to crypto apps\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"ls\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -la\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /Applications/\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" grep\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -i\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" ledger\"})]}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"ls\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -la\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /Applications/\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" grep\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -i\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" trezor\"})]}),`\n`,(0,e.jsx)(i.span,{className:\"line\"}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# Verify app signatures\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"codesign\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -dv\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" --verbose=4\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /Applications/[CryptoApp].app\"})]})]})})}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.img,{alt:\"VSCode Malicious Extension\",src:\"/images/blog/mac-malware-threats-simplestealth-glassworm-2026/vscode-malicious-extension-codoai.jpg\",width:\"1132\",height:\"646\"})}),`\n`,(0,e.jsx)(i.h3,{id:\"remediation-steps\",children:\"Remediation Steps\"}),`\n`,(0,e.jsx)(i.p,{children:\"If you installed a suspicious extension:\"}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsxs)(i.li,{children:[`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Immediately remove the extension\"})}),`\n`]}),`\n`,(0,e.jsxs)(i.li,{children:[`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Rotate all credentials:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Change all passwords (start with financial accounts)\"}),`\n`,(0,e.jsx)(i.li,{children:\"Regenerate SSH keys\"}),`\n`,(0,e.jsx)(i.li,{children:\"Revoke and regenerate API tokens\"}),`\n`,(0,e.jsx)(i.li,{children:\"Update 2FA seeds where possible\"}),`\n`]}),`\n`]}),`\n`,(0,e.jsxs)(i.li,{children:[`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Check crypto wallets:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Verify wallet applications are legitimate\"}),`\n`,(0,e.jsx)(i.li,{children:\"Move funds to a fresh wallet created on a clean device\"}),`\n`,(0,e.jsx)(i.li,{children:\"Monitor accounts for unauthorized transactions\"}),`\n`]}),`\n`]}),`\n`,(0,e.jsxs)(i.li,{children:[`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Consider system reinstall:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"For high-value targets, clean installation is recommended\"}),`\n`,(0,e.jsx)(i.li,{children:\"Restore only verified data from backups\"}),`\n`]}),`\n`]}),`\n`]}),`\n`,(0,e.jsx)(i.h2,{id:\"apple-notarized-malware-the-growing-problem\",children:\"Apple-Notarized Malware: The Growing Problem\"}),`\n`,(0,e.jsx)(i.h3,{id:\"what-is-notarization\",children:\"What Is Notarization?\"}),`\n`,(0,e.jsx)(i.p,{children:\"Apple's notarization process is designed to verify that software:\"}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Is from a known developer\"}),`\n`,(0,e.jsx)(i.li,{children:\"Has been scanned for malicious content\"}),`\n`,(0,e.jsx)(i.li,{children:\"Hasn't been tampered with\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:\"When software is notarized, Gatekeeper allows it to run without warnings.\"}),`\n`,(0,e.jsx)(i.h3,{id:\"the-problem\",children:\"The Problem\"}),`\n`,(0,e.jsx)(i.p,{children:\"In late 2025 and early 2026, multiple malware samples have passed Apple's notarization process:\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"MacSync Stealer:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Distributed with valid Developer ID\"}),`\n`,(0,e.jsx)(i.li,{children:\"Passed Apple's automated scanning\"}),`\n`,(0,e.jsx)(i.li,{children:\"Appeared legitimate to users and Gatekeeper\"}),`\n`,(0,e.jsx)(i.li,{children:\"Only detected after significant distribution\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Implications:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Users cannot rely solely on Gatekeeper\"}),`\n`,(0,e.jsx)(i.li,{children:'\"App Store and identified developers\" setting is insufficient'}),`\n`,(0,e.jsx)(i.li,{children:\"Additional security measures are essential\"}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"how-malware-passes-notarization\",children:\"How Malware Passes Notarization\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Techniques Used:\"})}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Clean submission, dirty update:\"}),\" Initial submission is clean; malicious code added via update\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Time-delayed activation:\"}),\" Malicious behavior activates after notarization checks\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Server-side payload:\"}),\" Benign app downloads malicious payload post-installation\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Obfuscation:\"}),\" Code obfuscated enough to pass automated scanning\"]}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"protection-strategies\",children:\"Protection Strategies\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Don't Trust Notarization Alone:\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"M 6,1 C 4.354992,1 3,2.354992 3,4 v 16 c 0,1.645008 1.354992,3 3,3 h 12 c 1.645008,0 3,-1.354992 3,-3 V 8 7 A 1.0001,1.0001 0 0 0 20.707031,6.2929687 l -5,-5 A 1.0001,1.0001 0 0 0 15,1 h -1 z m 0,2 h 7 v 3 c 0,1.645008 1.354992,3 3,3 h 3 v 11 c 0,0.564129 -0.435871,1 -1,1 H 6 C 5.4358712,21 5,20.564129 5,20 V 4 C 5,3.4358712 5.4358712,3 6,3 Z M 15,3.4140625 18.585937,7 H 16 C 15.435871,7 15,6.5641288 15,6 Z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"System Settings > Privacy & Security:\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:'- Use \"App Store\" only for maximum protection'})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"- Or manually verify applications even when notarized\"})})]})})}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Additional Verification:\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# Check developer certificate\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"codesign\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -dv\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" --verbose=4\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /Applications/SuspiciousApp.app\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" 2>&1\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" grep\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:' \"Developer ID\"'})]}),`\n`,(0,e.jsx)(i.span,{className:\"line\"}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# Verify against known good\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"shasum\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -a\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" 256\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /Applications/SuspiciousApp.app/Contents/MacOS/[binary]\"})]})]})})}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.img,{alt:\"macOS Privacy & Security Settings\",src:\"/images/blog/mac-malware-threats-simplestealth-glassworm-2026/macos-privacy-security-open-anyway.png\",width:\"1430\",height:\"1226\"})}),`\n`,(0,e.jsx)(i.h2,{id:\"xprotect-and-macos-built-in-protection\",children:\"XProtect and macOS Built-in Protection\"}),`\n`,(0,e.jsx)(i.h3,{id:\"current-xprotect-status\",children:\"Current XProtect Status\"}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Latest Version:\"}),\" 5325 (December 2025)\"]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Recent Signatures Added:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"MACOS.SOMA.DEENA\"}),`\n`,(0,e.jsx)(i.li,{children:\"MACOS.SOMA.DEPEA\"}),`\n`,(0,e.jsx)(i.li,{children:\"MACOS.SOMA.DETRA\"}),`\n`,(0,e.jsx)(i.li,{children:\"MACOS.SOMA.DELEA (Soma/Amos family)\"}),`\n`,(0,e.jsx)(i.li,{children:\"MACOS.ODYSSEY.DEENA (Odyssey family)\"}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"verify-xprotect-is-updated\",children:\"Verify XProtect Is Updated\"}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsxs)(i.li,{children:[\"Open \",(0,e.jsx)(i.strong,{children:\"System Settings > General > Software Update\"})]}),`\n`,(0,e.jsxs)(i.li,{children:[\"Click the \",(0,e.jsx)(i.strong,{children:\"info button\"}),\" (i) beside Automatic Updates\"]}),`\n`,(0,e.jsxs)(i.li,{children:[\"Ensure \",(0,e.jsx)(i.strong,{children:'\"Install Security Responses and system files\"'}),\" is enabled\"]}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Terminal Check:\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# Check XProtect version\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"system_profiler\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" SPInstallHistoryDataType\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" grep\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -A\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" 5\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:' \"XProtect\"'})]}),`\n`,(0,e.jsx)(i.span,{className:\"line\"}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# Or check directly\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"cat\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" grep\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -A\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" 1\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:' \"CFBundleShortVersionString\"'})]})]})})}),`\n`,(0,e.jsx)(i.h3,{id:\"limitations-of-xprotect\",children:\"Limitations of XProtect\"}),`\n`,(0,e.jsx)(i.p,{children:\"While XProtect provides essential protection, it has limitations:\"}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Signature-based:\"}),\" Only detects known malware\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Update lag:\"}),\" New malware may spread before signatures are added\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"No behavioral analysis:\"}),\" Cannot detect zero-day threats\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Limited scope:\"}),\" Focused on known threat families\"]}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"xprotect-remediator\",children:\"XProtect Remediator\"}),`\n`,(0,e.jsx)(i.p,{children:\"macOS includes XProtect Remediator, which runs periodically to scan for and remove known malware:\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Check Remediator Status:\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# List remediator modules\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"ls\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /Library/Apple/System/Library/CoreServices/XProtect.app/Contents/MacOS/\"})]})]})})}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.img,{alt:\"XProtect Remediator Modules\",src:\"/images/blog/mac-malware-threats-simplestealth-glassworm-2026/xprotect-remediator-modules.png\",width:\"1024\",height:\"754\"})}),`\n`,(0,e.jsx)(i.h2,{id:\"comprehensive-protection-strategy\",children:\"Comprehensive Protection Strategy\"}),`\n`,(0,e.jsx)(i.h3,{id:\"layer-1-system-hardening\",children:\"Layer 1: System Hardening\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Enable FileVault:\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"M 6,1 C 4.354992,1 3,2.354992 3,4 v 16 c 0,1.645008 1.354992,3 3,3 h 12 c 1.645008,0 3,-1.354992 3,-3 V 8 7 A 1.0001,1.0001 0 0 0 20.707031,6.2929687 l -5,-5 A 1.0001,1.0001 0 0 0 15,1 h -1 z m 0,2 h 7 v 3 c 0,1.645008 1.354992,3 3,3 h 3 v 11 c 0,0.564129 -0.435871,1 -1,1 H 6 C 5.4358712,21 5,20.564129 5,20 V 4 C 5,3.4358712 5.4358712,3 6,3 Z M 15,3.4140625 18.585937,7 H 16 C 15.435871,7 15,6.5641288 15,6 Z\" fill=\"currentColor\" /></svg>',children:(0,e.jsx)(i.code,{children:(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"System Settings > Privacy & Security > FileVault > Turn On\"})})})})}),`\n`,(0,e.jsx)(i.p,{children:\"FileVault encrypts your entire disk, protecting data if your Mac is stolen.\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Enable Firewall:\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"M 6,1 C 4.354992,1 3,2.354992 3,4 v 16 c 0,1.645008 1.354992,3 3,3 h 12 c 1.645008,0 3,-1.354992 3,-3 V 8 7 A 1.0001,1.0001 0 0 0 20.707031,6.2929687 l -5,-5 A 1.0001,1.0001 0 0 0 15,1 h -1 z m 0,2 h 7 v 3 c 0,1.645008 1.354992,3 3,3 h 3 v 11 c 0,0.564129 -0.435871,1 -1,1 H 6 C 5.4358712,21 5,20.564129 5,20 V 4 C 5,3.4358712 5.4358712,3 6,3 Z M 15,3.4140625 18.585937,7 H 16 C 15.435871,7 15,6.5641288 15,6 Z\" fill=\"currentColor\" /></svg>',children:(0,e.jsx)(i.code,{children:(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"System Settings > Network > Firewall > Turn On\"})})})})}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Gatekeeper Settings:\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"M 6,1 C 4.354992,1 3,2.354992 3,4 v 16 c 0,1.645008 1.354992,3 3,3 h 12 c 1.645008,0 3,-1.354992 3,-3 V 8 7 A 1.0001,1.0001 0 0 0 20.707031,6.2929687 l -5,-5 A 1.0001,1.0001 0 0 0 15,1 h -1 z m 0,2 h 7 v 3 c 0,1.645008 1.354992,3 3,3 h 3 v 11 c 0,0.564129 -0.435871,1 -1,1 H 6 C 5.4358712,21 5,20.564129 5,20 V 4 C 5,3.4358712 5.4358712,3 6,3 Z M 15,3.4140625 18.585937,7 H 16 C 15.435871,7 15,6.5641288 15,6 Z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"System Settings > Privacy & Security > Security:\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:'- \"App Store\" for maximum security'})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:'- \"App Store and identified developers\" for balance'})})]})})}),`\n`,(0,e.jsx)(i.h3,{id:\"layer-2-browser-security\",children:\"Layer 2: Browser Security\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Safari Settings:\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"M 6,1 C 4.354992,1 3,2.354992 3,4 v 16 c 0,1.645008 1.354992,3 3,3 h 12 c 1.645008,0 3,-1.354992 3,-3 V 8 7 A 1.0001,1.0001 0 0 0 20.707031,6.2929687 l -5,-5 A 1.0001,1.0001 0 0 0 15,1 h -1 z m 0,2 h 7 v 3 c 0,1.645008 1.354992,3 3,3 h 3 v 11 c 0,0.564129 -0.435871,1 -1,1 H 6 C 5.4358712,21 5,20.564129 5,20 V 4 C 5,3.4358712 5.4358712,3 6,3 Z M 15,3.4140625 18.585937,7 H 16 C 15.435871,7 15,6.5641288 15,6 Z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"Safari > Settings > Privacy:\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:'- Enable \"Prevent cross-site tracking\"'})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:'- Enable \"Hide IP address from trackers\"'})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:'- Enable \"Block all cookies\" (strict) or \"Allow from websites I visit\"'})})]})})}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Extension Hygiene:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Remove unused extensions\"}),`\n`,(0,e.jsx)(i.li,{children:\"Only install from official stores\"}),`\n`,(0,e.jsx)(i.li,{children:\"Verify extension permissions\"}),`\n`,(0,e.jsx)(i.li,{children:\"Review extensions quarterly\"}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"layer-3-application-security\",children:\"Layer 3: Application Security\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Download Verification:\"})}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Only download from official sources\"}),`\n`,(0,e.jsx)(i.li,{children:\"Verify checksums when provided\"}),`\n`,(0,e.jsx)(i.li,{children:\"Check code signatures before installation\"}),`\n`,(0,e.jsx)(i.li,{children:'Be suspicious of \"cracked\" or \"free\" versions of paid software'}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Application Permissions:\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"M 6,1 C 4.354992,1 3,2.354992 3,4 v 16 c 0,1.645008 1.354992,3 3,3 h 12 c 1.645008,0 3,-1.354992 3,-3 V 8 7 A 1.0001,1.0001 0 0 0 20.707031,6.2929687 l -5,-5 A 1.0001,1.0001 0 0 0 15,1 h -1 z m 0,2 h 7 v 3 c 0,1.645008 1.354992,3 3,3 h 3 v 11 c 0,0.564129 -0.435871,1 -1,1 H 6 C 5.4358712,21 5,20.564129 5,20 V 4 C 5,3.4358712 5.4358712,3 6,3 Z M 15,3.4140625 18.585937,7 H 16 C 15.435871,7 15,6.5641288 15,6 Z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"System Settings > Privacy & Security:\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"- Review Full Disk Access\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"- Review Accessibility permissions\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"- Remove unused application permissions\"})})]})})}),`\n`,(0,e.jsx)(i.h3,{id:\"layer-4-network-security\",children:\"Layer 4: Network Security\"}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"DNS Security:\"}),`\nConsider using a secure DNS provider:`]}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Cloudflare: 1.1.1.1\"}),`\n`,(0,e.jsx)(i.li,{children:\"Quad9: 9.9.9.9\"}),`\n`,(0,e.jsx)(i.li,{children:\"NextDNS: Custom blocking\"}),`\n`]}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"VPN Usage:\"}),`\nUse a reputable VPN on untrusted networks.`]}),`\n`,(0,e.jsx)(i.h3,{id:\"layer-5-monitoring-and-detection\",children:\"Layer 5: Monitoring and Detection\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Regular Checks:\"})}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# Check for unusual launch agents\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"ls\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -la\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" ~/Library/LaunchAgents\"})]}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"ls\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -la\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /Library/LaunchAgents\"})]}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"ls\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -la\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /Library/LaunchDaemons\"})]}),`\n`,(0,e.jsx)(i.span,{className:\"line\"}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# Check running processes\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"ps\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" aux\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" grep\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -v\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:' \"^root\\\\|^_\"'})]}),`\n`,(0,e.jsx)(i.span,{className:\"line\"}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# Check network connections\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"lsof\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -i\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -n\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -P\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" grep\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" ESTABLISHED\"})]})]})})}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Third-Party Security Tools:\"}),`\nConsider reputable security software:`]}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Malwarebytes for Mac\"}),\" (Detection and removal)\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Little Snitch\"}),\" (Network monitoring)\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"BlockBlock\"}),\" (Persistence monitoring)\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"KnockKnock\"}),\" (Startup item scanning)\"]}),`\n`]}),`\n`,(0,e.jsx)(i.h2,{id:\"incident-response-if-youre-infected\",children:\"Incident Response: If You're Infected\"}),`\n`,(0,e.jsx)(i.h3,{id:\"step-1-isolate\",children:\"Step 1: Isolate\"}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Disconnect from the internet (Wi-Fi off, Ethernet unplugged)\"}),`\n`,(0,e.jsx)(i.li,{children:\"Don't log into any accounts\"}),`\n`,(0,e.jsx)(i.li,{children:\"Don't enter any passwords\"}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"step-2-assess\",children:\"Step 2: Assess\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Determine scope:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"What application/file caused the infection?\"}),`\n`,(0,e.jsx)(i.li,{children:\"When did the infection occur?\"}),`\n`,(0,e.jsx)(i.li,{children:\"What accounts might be compromised?\"}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"step-3-document\",children:\"Step 3: Document\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Before removing anything:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Screenshot any suspicious activity\"}),`\n`,(0,e.jsx)(i.li,{children:\"Note file paths and names\"}),`\n`,(0,e.jsx)(i.li,{children:\"Record timeline of events\"}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"step-4-remove\",children:\"Step 4: Remove\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Option A: Targeted Removal\"})}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Boot into Safe Mode\"}),`\n`,(0,e.jsx)(i.li,{children:\"Run Malwarebytes or similar\"}),`\n`,(0,e.jsx)(i.li,{children:\"Remove identified threats\"}),`\n`,(0,e.jsx)(i.li,{children:\"Clear browser data\"}),`\n`,(0,e.jsx)(i.li,{children:\"Restart and monitor\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Option B: Clean Installation (Recommended for Severe Infections)\"})}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Back up essential data to external drive (files only, not applications)\"}),`\n`,(0,e.jsx)(i.li,{children:\"Boot to Recovery Mode\"}),`\n`,(0,e.jsx)(i.li,{children:\"Erase Macintosh HD\"}),`\n`,(0,e.jsx)(i.li,{children:\"Reinstall macOS\"}),`\n`,(0,e.jsx)(i.li,{children:\"Restore data manually (not from backup)\"}),`\n`,(0,e.jsx)(i.li,{children:\"Reinstall applications from official sources\"}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"step-5-recover\",children:\"Step 5: Recover\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Credential Rotation:\"})}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Change all passwords (from a clean device)\"}),`\n`,(0,e.jsx)(i.li,{children:\"Enable 2FA everywhere possible\"}),`\n`,(0,e.jsx)(i.li,{children:\"Revoke all API tokens and regenerate\"}),`\n`,(0,e.jsx)(i.li,{children:\"Review and revoke OAuth authorizations\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Financial Monitoring:\"})}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Check cryptocurrency wallets\"}),`\n`,(0,e.jsx)(i.li,{children:\"Review bank and credit card statements\"}),`\n`,(0,e.jsx)(i.li,{children:\"Consider credit freeze if personal info exposed\"}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"step-6-prevent\",children:\"Step 6: Prevent\"}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Implement protection strategies from this guide\"}),`\n`,(0,e.jsx)(i.li,{children:\"Maintain regular backups\"}),`\n`,(0,e.jsx)(i.li,{children:\"Stay informed about new threats\"}),`\n`]}),`\n`,(0,e.jsx)(i.h2,{id:\"enterprise-security-considerations\",children:\"Enterprise Security Considerations\"}),`\n`,(0,e.jsx)(i.h3,{id:\"for-it-administrators\",children:\"For IT Administrators\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"MDM Recommendations:\"})}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Enforce Gatekeeper settings via MDM\"}),`\n`,(0,e.jsx)(i.li,{children:\"Deploy endpoint detection and response (EDR)\"}),`\n`,(0,e.jsx)(i.li,{children:\"Implement application allowlisting where feasible\"}),`\n`,(0,e.jsx)(i.li,{children:\"Monitor for unauthorized applications\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"User Training:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Phishing awareness\"}),`\n`,(0,e.jsx)(i.li,{children:\"Safe download practices\"}),`\n`,(0,e.jsx)(i.li,{children:\"Reporting procedures for suspicious activity\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Incident Response Planning:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Define escalation procedures\"}),`\n`,(0,e.jsx)(i.li,{children:\"Establish communication channels\"}),`\n`,(0,e.jsx)(i.li,{children:\"Maintain offline backup of critical data\"}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"recommended-enterprise-tools\",children:\"Recommended Enterprise Tools\"}),`\n`,(0,e.jsxs)(i.table,{children:[(0,e.jsx)(i.thead,{children:(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.th,{children:\"Category\"}),(0,e.jsx)(i.th,{children:\"Tool\"}),(0,e.jsx)(i.th,{children:\"Purpose\"})]})}),(0,e.jsxs)(i.tbody,{children:[(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"EDR\"}),(0,e.jsx)(i.td,{children:\"CrowdStrike, SentinelOne\"}),(0,e.jsx)(i.td,{children:\"Threat detection and response\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"MDM\"}),(0,e.jsx)(i.td,{children:\"Jamf, Mosyle\"}),(0,e.jsx)(i.td,{children:\"Device management\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"SIEM\"}),(0,e.jsx)(i.td,{children:\"Splunk, Elastic\"}),(0,e.jsx)(i.td,{children:\"Log analysis\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Email Security\"}),(0,e.jsx)(i.td,{children:\"Proofpoint, Mimecast\"}),(0,e.jsx)(i.td,{children:\"Phishing protection\"})]})]})]}),`\n`,(0,e.jsx)(i.h2,{id:\"staying-informed\",children:\"Staying Informed\"}),`\n`,(0,e.jsx)(i.h3,{id:\"reliable-security-resources\",children:\"Reliable Security Resources\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Apple Security Updates:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:(0,e.jsx)(i.a,{href:\"https://support.apple.com/en-us/HT201222\",children:\"Apple Security Updates\"})}),`\n`,(0,e.jsx)(i.li,{children:\"Subscribe to security announcement emails\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Security News:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.a,{href:\"https://objective-see.org/\",children:\"Objective-See\"}),\" - Mac-focused security research\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.a,{href:\"https://www.bleepingcomputer.com/\",children:\"BleepingComputer\"}),\" - General security news\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.a,{href:\"https://thehackernews.com/\",children:\"The Hacker News\"}),\" - Security news\"]}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Threat Intelligence:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.a,{href:\"https://www.virustotal.com/\",children:\"VirusTotal\"}),\" - File analysis\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.a,{href:\"https://otx.alienvault.com/\",children:\"AlienVault OTX\"}),\" - Threat indicators\"]}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"security-communities\",children:\"Security Communities\"}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Reddit\"}),\": r/macsysadmin, r/cybersecurity\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Slack\"}),\": MacAdmins Slack\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Twitter/X\"}),\": Follow security researchers\"]}),`\n`]}),`\n`,(0,e.jsx)(i.h2,{id:\"future-outlook-what-to-expect\",children:\"Future Outlook: What to Expect\"}),`\n`,(0,e.jsx)(i.h3,{id:\"emerging-threats\",children:\"Emerging Threats\"}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"AI-Powered Malware:\"}),`\nSimpleStealth is likely just the beginning. Expect:`]}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"More sophisticated AI-generated code\"}),`\n`,(0,e.jsx)(i.li,{children:\"Better evasion of security tools\"}),`\n`,(0,e.jsx)(i.li,{children:\"Faster variant generation\"}),`\n`]}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Supply Chain Attacks:\"}),`\nDeveloper targeting will continue:`]}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"More compromised development tools\"}),`\n`,(0,e.jsx)(i.li,{children:\"IDE extension attacks beyond VSCode\"}),`\n`,(0,e.jsx)(i.li,{children:\"Compromised package managers\"}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"macOS-Specific Exploits:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Increased focus on Apple Silicon vulnerabilities\"}),`\n`,(0,e.jsx)(i.li,{children:\"TCC (Transparency, Consent, and Control) bypasses\"}),`\n`,(0,e.jsx)(i.li,{children:\"Kernel extension alternatives exploitation\"}),`\n`]}),`\n`,(0,e.jsx)(i.h3,{id:\"apples-response\",children:\"Apple's Response\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Expected Improvements:\"})}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Enhanced notarization scanning\"}),`\n`,(0,e.jsx)(i.li,{children:\"Faster XProtect updates\"}),`\n`,(0,e.jsx)(i.li,{children:\"macOS Tahoe 26.3 Background Security Improvements\"}),`\n`,(0,e.jsx)(i.li,{children:\"Improved Gatekeeper heuristics\"}),`\n`]}),`\n`,(0,e.jsx)(i.h2,{id:\"conclusion-security-is-a-process\",children:\"Conclusion: Security Is a Process\"}),`\n`,(0,e.jsx)(i.p,{children:\"The threats covered in this guide\\u2014SimpleStealth, GlassWorm, and notarized malware\\u2014represent a new era of Mac security challenges. The days of assuming Macs are inherently safe are over.\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Key Takeaways:\"})}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Don't trust notarization alone\"}),\" - Malware can pass Apple's checks\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Verify everything\"}),\" - Even legitimate-looking software deserves scrutiny\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Developers are targets\"}),\" - Extra caution with development tools\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"AI changes the game\"}),\" - Expect more sophisticated, rapidly evolving threats\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Layer your defenses\"}),\" - No single protection is sufficient\"]}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"Protection Checklist:\"})}),`\n`,(0,e.jsxs)(i.ul,{className:\"contains-task-list\",children:[`\n`,(0,e.jsxs)(i.li,{className:\"task-list-item\",children:[(0,e.jsx)(i.input,{type:\"checkbox\",disabled:!0}),\" \",\"XProtect updated and automatic updates enabled\"]}),`\n`,(0,e.jsxs)(i.li,{className:\"task-list-item\",children:[(0,e.jsx)(i.input,{type:\"checkbox\",disabled:!0}),\" \",\"FileVault encryption enabled\"]}),`\n`,(0,e.jsxs)(i.li,{className:\"task-list-item\",children:[(0,e.jsx)(i.input,{type:\"checkbox\",disabled:!0}),\" \",\"Firewall enabled\"]}),`\n`,(0,e.jsxs)(i.li,{className:\"task-list-item\",children:[(0,e.jsx)(i.input,{type:\"checkbox\",disabled:!0}),\" \",\"Gatekeeper set appropriately\"]}),`\n`,(0,e.jsxs)(i.li,{className:\"task-list-item\",children:[(0,e.jsx)(i.input,{type:\"checkbox\",disabled:!0}),\" \",\"Browser extensions audited\"]}),`\n`,(0,e.jsxs)(i.li,{className:\"task-list-item\",children:[(0,e.jsx)(i.input,{type:\"checkbox\",disabled:!0}),\" \",\"Development tool extensions verified\"]}),`\n`,(0,e.jsxs)(i.li,{className:\"task-list-item\",children:[(0,e.jsx)(i.input,{type:\"checkbox\",disabled:!0}),\" \",\"Regular backup strategy in place\"]}),`\n`,(0,e.jsxs)(i.li,{className:\"task-list-item\",children:[(0,e.jsx)(i.input,{type:\"checkbox\",disabled:!0}),\" \",\"Incident response plan ready\"]}),`\n`,(0,e.jsxs)(i.li,{className:\"task-list-item\",children:[(0,e.jsx)(i.input,{type:\"checkbox\",disabled:!0}),\" \",\"Security news monitoring established\"]}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:\"Stay vigilant, stay updated, and remember that security is not a destination but an ongoing process.\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsxs)(i.em,{children:[\"For more macOS security guidance, explore our \",(0,e.jsx)(i.a,{href:\"/blog/macos-tahoe-security-privacy-complete-guide-2025\",children:\"Security & Privacy Complete Guide\"}),\" and \",(0,e.jsx)(i.a,{href:\"/blog/macos-tahoe-26-2-security-update-complete-analysis-2025\",children:\"macOS Tahoe 26.2 Security Update Analysis\"}),\".\"]})})]})}function o(n={}){let{wrapper:i}=n.components||{};return i?(0,e.jsx)(i,{...n,children:(0,e.jsx)(d,{...n})}):d(n)}return v(b);})();\n;return Component;","toc":[{"title":"The Current Mac Threat Landscape","url":"#the-current-mac-threat-landscape","depth":2},{"title":"Why Mac Malware Is Increasing","url":"#why-mac-malware-is-increasing","depth":3},{"title":"2026 Threat Statistics","url":"#2026-threat-statistics","depth":3},{"title":"SimpleStealth: First AI-Assisted Mac Malware","url":"#simplestealth-first-ai-assisted-mac-malware","depth":2},{"title":"Discovery","url":"#discovery","depth":3},{"title":"How It Works","url":"#how-it-works","depth":3},{"title":"Detection Status","url":"#detection-status","depth":3},{"title":"Protection Against SimpleStealth","url":"#protection-against-simplestealth","depth":3},{"title":"GlassWorm: VSCode Extension Attack Campaign","url":"#glassworm-vscode-extension-attack-campaign","depth":2},{"title":"Overview","url":"#overview","depth":3},{"title":"Attack Vector","url":"#attack-vector","depth":3},{"title":"Capabilities","url":"#capabilities","depth":3},{"title":"Affected Extensions","url":"#affected-extensions","depth":3},{"title":"Detection and Removal","url":"#detection-and-removal","depth":3},{"title":"Remediation Steps","url":"#remediation-steps","depth":3},{"title":"Apple-Notarized Malware: The Growing Problem","url":"#apple-notarized-malware-the-growing-problem","depth":2},{"title":"What Is Notarization?","url":"#what-is-notarization","depth":3},{"title":"The Problem","url":"#the-problem","depth":3},{"title":"How Malware Passes Notarization","url":"#how-malware-passes-notarization","depth":3},{"title":"Protection Strategies","url":"#protection-strategies","depth":3},{"title":"XProtect and macOS Built-in Protection","url":"#xprotect-and-macos-built-in-protection","depth":2},{"title":"Current XProtect Status","url":"#current-xprotect-status","depth":3},{"title":"Verify XProtect Is Updated","url":"#verify-xprotect-is-updated","depth":3},{"title":"Limitations of XProtect","url":"#limitations-of-xprotect","depth":3},{"title":"XProtect Remediator","url":"#xprotect-remediator","depth":3},{"title":"Comprehensive Protection Strategy","url":"#comprehensive-protection-strategy","depth":2},{"title":"Layer 1: System Hardening","url":"#layer-1-system-hardening","depth":3},{"title":"Layer 2: Browser Security","url":"#layer-2-browser-security","depth":3},{"title":"Layer 3: Application Security","url":"#layer-3-application-security","depth":3},{"title":"Layer 4: Network Security","url":"#layer-4-network-security","depth":3},{"title":"Layer 5: Monitoring and Detection","url":"#layer-5-monitoring-and-detection","depth":3},{"title":"Incident Response: If You're Infected","url":"#incident-response-if-youre-infected","depth":2},{"title":"Step 1: Isolate","url":"#step-1-isolate","depth":3},{"title":"Step 2: Assess","url":"#step-2-assess","depth":3},{"title":"Step 3: Document","url":"#step-3-document","depth":3},{"title":"Step 4: Remove","url":"#step-4-remove","depth":3},{"title":"Step 5: Recover","url":"#step-5-recover","depth":3},{"title":"Step 6: Prevent","url":"#step-6-prevent","depth":3},{"title":"Enterprise Security Considerations","url":"#enterprise-security-considerations","depth":2},{"title":"For IT Administrators","url":"#for-it-administrators","depth":3},{"title":"Recommended Enterprise Tools","url":"#recommended-enterprise-tools","depth":3},{"title":"Staying Informed","url":"#staying-informed","depth":2},{"title":"Reliable Security Resources","url":"#reliable-security-resources","depth":3},{"title":"Security Communities","url":"#security-communities","depth":3},{"title":"Future Outlook: What to Expect","url":"#future-outlook-what-to-expect","depth":2},{"title":"Emerging Threats","url":"#emerging-threats","depth":3},{"title":"Apple's Response","url":"#apples-response","depth":3},{"title":"Conclusion: Security Is a Process","url":"#conclusion-security-is-a-process","depth":2}],"estimatedTime":12}