Apple pushed a fresh malware signature set to every Mac this week, and the version number tells its own story. XProtect now stands at 5372, arriving less than a week after the scanner moved to 5371 in early November.
The update landed late on November 10 and was logged by Howard Oakley at The Eclectic Light Company, who tracks each release because Apple publishes no changelog alongside it. What the build reveals is volume, not explanation: hundreds of Yara rules spanning years of macOS malware were revised in one delivery.
A scanner that grows without a word
Apple has never documented what 5372 detects, which is why a major build is worth watching. Signature pushes typically answer threats already circulating, and XProtect runs automatically on every supported Mac whether or not the owner installed a third-party tool.
What the update clears out
Alongside the amendments, the package adds five signatures for families tracked as MACOS.ANGRYORB.GOFU, MACOS.BOATLOAD.CLPIA and MACOS.BOATLOAD.CLHTA, plus two MACOS.BRUSQUEBARNACLE entries.
It also retires ten older definitions. Among the removals are OSX.XAgent.A, OSX.iKitten.A and OSX.Hmining.A, names tied to cryptocurrency miners and adware that the company now judges low-value at scan time.
The AppleScript rule file works the same way: one new entry for MACOS.OSASCRIPT.REETCHRE, with three for MACOS.OSASCRIPT.DUVAST, DUCUHA and DUSTCO withdrawn.
How to tell whether your Mac took it
On Sequoia, Tahoe and Golden Gate the definitions usually arrive on their own through iCloud. Running “sudo xprotect check” reports the active version, and “sudo xprotect update” forces a download if the number reads low. Older builds require checking under About This Mac through the Installations list.
Source: The Eclectic Light Company
