The Art of Mac Malware

3 Capabilities

When analyzing malware, it’s often paramount to understand what happens after a successful infection. In other words, what does the malware actually do? Though the answer to this question will depend on a particular malware’s goals, it may include surveying the system, escalating privileges, executing commands, exfiltrating files, ransoming user files, or even mining cryptocurrency. In this chapter, we’ll take a detailed look at the capabilities commonly found in Mac malware.

Categorizing Mac Malware Capabilities

A malware’s capabilities are largely dependent on the malware’s type. Generally speaking, we can place Mac malware ...