Apple updated its built-in macOS malware scanner XProtect to version 5352 on July 24, adding YARA detection rules for two new variants of the BoatLoad infostealer family. The update includes signatures for MACOS.BOATLOAD.REWA and MACOS.BOATLOAD.REFU, which are the latest additions to a growing malware family that XProtect has been tracking since mid-July.
The 5352 revision also removes older detection rules for MACOS.DUBROBBER.D and MACOS.DUBROBBER.E, suggesting Apple’s security team considers those variants sufficiently dormant or obsolete. DUBROBBER, a macOS backdoor first documented in 2024, had been the subject of three prior XProtect signature updates.
BoatLoad is an infostealer family that targets macOS systems to extract credentials, browser data, and other sensitive information. Prior to this week’s release, XProtect version 5351 had added six BoatLoad detection rules covering variants STCRST, PRIN, and PEME alongside other malware families. The July 24 refresh extends coverage to two additional BoatLoad strains that may be circulating in active campaigns.
XProtect functions as Apple’s primary on-device malware detection engine, using YARA-based pattern matching to identify known threats before they can execute. Updates arrive through Apple’s background security update mechanism and iCloud infrastructure, requiring no user action on macOS Sequoia, Tahoe, and Golden Gate systems. Users on older macOS versions receive the update through System Preferences or can trigger it manually via the terminal with sudo xprotect update.
The removal of the DUBROBBER rules alongside the BoatLoad additions reflects Apple’s ongoing housekeeping of XProtect’s signature database, pruning detection for malware families that no longer pose an active threat while expanding coverage for emerging strains. Security researcher John first flagged the update, which was documented by the Eclectic Light Company.
