Apple XProtect 5362 Adds macOS Malware Detection Rules

Apple’s XProtect update 5362 changes the detection rules used to identify suspected macOS malware, adding new signatures and revising or removing existing ones. The update first appeared through iCloud for macOS Sequoia and later, then became available through softwareupdate for all Macs. The rule changes are the main technical detail available; Apple hasn’t described the threats they target or explained why the rules changed.

What changed in version 5362

The release adds 15 Yara rules, removes one, and amends three others. Yara rules let software match files or other data against patterns associated with a detection category. Their names identify Apple’s internal detection labels, but the names alone don’t establish what a sample does, how widespread it is, or whether it has been seen in active attacks.

The 15 new rules cover these labels:

• MACOS.ADLOAD.FOST
• MACOS.ANGRYORB.KECO and MACOS.ANGRYORB.LOITHE
• MACOS.BOATLOAD.GAPRDO
• MACOS.BRUSQUEBARNACLE.AEZLPAST
• MACOS.CONFUSEDCABAL.CHBRIMA, MACOS.CONFUSEDCABAL.PIAIPRA, MACOS.CONFUSEDCABAL.RERSKEA, MACOS.CONFUSEDCABAL.CHBRCOSLA, MACOS.CONFUSEDCABAL.ENAGIMA and MACOS.CONFUSEDCABAL.DYLOA
• MACOS.REGRESSIVESALMON.B6OSST
• MACOS.SHADYSHOELACE.HEHEBACO, MACOS.SHADYSHOELACE.PAAUSE and MACOS.SHADYSHOELACE.PAKEUN

Apple also removes the Yara rule MACOS.ADLOAD.FMT and amends the rules MACOS.SHADYSHOELACE.LOADCO, MACOS.ANGRYORB.RUC2FO and MACOS.ANGRYORB.RUCOX8. These edits show that the release isn’t simply adding coverage: some existing detections are being adjusted, while another is being retired. Without Apple’s explanation or the rule contents, it’s not possible to tell whether those revisions reflect new samples, improved matching, or a change in how a family is classified.

Osascript rules get a separate revision

The update also changes the Osascript rules in XPScripts.yr. It adds six entries: MACOS.OSASCRIPT.COTA, MACOS.OSASCRIPT.RELABYSH, MACOS.OSASCRIPT.REETRE, MACOS.OSASCRIPT.COIMA, MACOS.OSASCRIPT.COLOA and MACOS.OSASCRIPT.SYPR. The rule for MACOS.OSASCRIPT.SHLAMAA is amended.

There’s an apparent inconsistency in the supplied change list: it says MACOS.OSASCRIPT.SYPR is both added and removed. That could reflect a change in rule organization or an error in the listing, but the available information doesn’t resolve it. Readers shouldn’t treat the duplicate entry as evidence that the detection is simply absent or present without checking the installed version.

For Mac administrators, rule counts are a useful indication that detection data has changed, but they don’t reveal the operational impact by themselves. A new rule may improve recognition of particular files or scripts; an amended rule may alter what gets matched. The practical effect depends on the rule details and the software it encounters. Apple hasn’t published enough information here to assess false-positive risk, identify affected applications, or compare detection performance with the previous version.

Checking and installing the update

At first, version 5362 was available through iCloud only for Sequoia and later. The article’s original instructions suggest checking the installed XProtect version in Terminal with:

sudo xprotect check

If the check reports version 5362 while the Mac still appears to have an older version installed, the suggested command to request an update is:

sudo xprotect update

That command requires an administrator password. The reported behavior was uneven: it appeared to work for Golden Gate, might work for Tahoe, and returned errors rather than updating Sequoia. The article credits Paul with pointing out the Sequoia problem. These notes describe the state before the later distribution change, so they shouldn’t be read as a guarantee that the command will behave identically on every system.

A postscript dated 29 September 2026 at 06:25 GMT says version 5362 had subsequently become available through softwareupdate and should be available for all Macs. That broader availability matters more to most users than the initial Sequoia-and-later rollout: it gives systems a standard update route rather than relying on the narrower iCloud delivery described at first.

What to watch

SilentKnight and SystHist provide listings of security data file versions for systems from El Capitan to Golden Gate, through their product page at eclecticlight.co/lockrattler-systhist/. Such version histories can help technicians confirm which data a Mac has received, especially when the update mechanism and the version displayed by the system don’t appear to agree.

The immediate takeaway is straightforward: XProtect 5362 makes a substantial set of detection-rule changes, but the rule names offer only a partial view of what’s new. Users can check that their Macs have received the version; teams managing fleets should verify coverage across their supported macOS releases and keep an eye out for clearer detail about the SYPR entry and the Sequoia update errors.