Apple has pushed an update to XProtect

Apple has pushed an update today to the data files used by XProtect, bringing its version number to 2134, dated 29 October 2020. There’s still no sign of MRT 1.69, though.

Apple doesn’t release information about what these updates add or change, and now obfuscates the identities of malware detected by XProtect using internal code names. XProtect’s Yara definitions have been updated to include two new detection signatures for MACOS.6e7d4c2 and MACOS.d4735e3, and modifications to those for MACOS.8032420, MACOS.489e70f, MACOS.e79dc35, MACOS.de444f2, MACOS.b70290c, and MACOS.22d71e9.

You can check whether this update has been installed by opening System Information via About This Mac, and selecting the Installations item under Software.

A full listing of security data file versions is given by SilentKnight, LockRattler and SystHist for El Capitan, Sierra, High Sierra, Mojave and Catalina, available from their product page. If your Mac has not yet installed this update, you can force an update using SilentKnight, LockRattler, or at the command line.

I have updated the reference pages here which are accessed directly from LockRattler 4.2 and later using its Check blog button.

I maintain lists of the current versions of security data files for Catalina on this page, Mojave on this page, High Sierra on this page, Sierra on this page, and El Capitan on this page.

Thanks to Phil Stokes for the correction: MACOS.d4735e3 is new to this version.