A fresh malware signature rollout has landed on Macs running Sequoia and later, and once again Apple has said nothing about what prompted it.
The update moves XProtect, the scanner built into every macOS install, to build 5367. It arrived midweek and was distributed through iCloud rather than a full system update, so most owners will never see it happen.
What changed inside the rule set
Howard Oakley, who tracks the component weekly on The Eclectic Light Company, reports the main Yara collection came through untouched. All the movement sat in XPScripts.yr, the file holding detection logic for AppleScript-based threats.
Two edits there. One brand-new entry covers MACOS.OSASCRIPT.ANJXLOOC, a label that had not appeared in the scanner before. The other revises the existing MACOS.ANGRYORB.JXDR signature, which now looks for a different pattern than the version it replaces.
Apple publishes no release notes for these silent definitions, so the takeaway is narrow. Either a previously unseen script-based sample reached its threat pipeline, or a known one mutated enough to need a wider net.
Why the quiet channel matters
Because these updates ride on iCloud, Apple can push detection for a live Mac campaign in hours, without a point release or a reboot request. That speed is the point. The cost is opacity: no notification, no changelog, no way to judge whether the new rule targets a threat you face.
Verification stays manual. Owners on Sequoia, Tahoe or Golden Gate can run sudo xprotect check to see which build is active. SilentKnight gives a fuller view of installed security data versions; the label to look for is XProtectPlistConfigData_10_15-5367.
The honest summary for defenders: one new AppleScript family name, one revised rule, no CVE, and no public statement on either.
