A quiet signature drop with three new malware names
Apple has pushed its weekly malware signature update again, moving XProtect to build 5366 everywhere. The refresh follows 5363 by days and carries no explanation of what it blocks. That silence is routine, but the contents are not: the release attaches detections for three families the scanner had not named before.
What the new rules actually watch
The build adds six YARA rules split across three payload families. Two cover a cluster called BRUSQUEBARNACLE, two target LOATHESOMELABELMAKER, and two flag TIMELYTURTLE. Apple also inserted a private rule keyed to OSACompiledJXA, tightening how the scanner recognizes compiled JavaScript automation. The companion XPScripts file picks up the same rule plus two additions named OSASCRIPT.BRICCHLO and OSASCRIPT.BRJXDRHISC, extending coverage of the osascript path attackers abuse to run code without a compiled binary.
How to check a Mac and force the update
Machines on Sequoia and later receive the definition through iCloud, so most never see it land. To confirm the version, admins can open System Information, select Software, and inspect the Installations list, or run sudo xprotect check in Terminal. If that reports 5366 while the system still shows an older build, sudo xprotect update should pull it down. Utilities like SilentKnight label this release XProtectPlistConfigData_10_15-5366.
Why a signature bump still matters
XProtect is the last automated line on a Mac that never gets a notification or a reboot prompt. Each quiet build is the visible edge of Apple’s response to fresh samples, and the rule names give defenders their only early signal about what is circulating. Malware authors rarely announce a new family, so the detection list frequently moves before any public writeup exists. One macOS 27 machine has already been reported failing to install the bundle, leaving that system on stale definitions.
