Thirteen builds in six weeks
Apple’s built-in malware scanner usually moves in small increments. Since late September it has climbed from 5363 to 5371, and Tuesday’s jump from 5368 to 5371 was the largest of the run.
The engine ships with macOS, not through the App Store, and Apple never says what changed. Owners learn details only when someone diffs the rule files.
What arrived in version 5371
Twelve new Yara signatures arrived, aimed at three families. NimbleRAT and ShadyShoelace each picked up several, BoATLOAD appeared four times, and Odyssey added three. A long tail of older rules was amended, mostly file-size adjustments.
Eight signatures were retired, among them iWorm, two SMSSend entries and both Honkbox variants.
Separately, the AppleScript rules grew by ten, several built around the Osascript engine that adware and loaders abuse to run commands without a compiled binary. That pairing is worth noting, since script-only helpers leave almost nothing on disk to scan.
The delivery is now iCloud
From Sequoia onward the payload rides in via iCloud instead of the usual software update path, so it typically installs with no reboot. A Mac that has been offline for a while can sit on an old rule set indefinitely.
Simon Wardley’s SilentKnight lists the build as XProtectPlistConfigData_10_15-5371. Forcing the update by hand works on Golden Gate; Sequoia often needs a manual download instead.
Why the cadence matters
XProtect is the only layer that updates between OS releases. When a new malware family appears, the gap between its first sighting and the next signature drop is the window a Mac has before the file can even be caught on arrival.
Nothing in the rule names ties this release to a named campaign. The families are already known, and the changes read as coverage work, not an emergency response.
