Apple has just pushed two updates, to the data files used by XProtect, bringing its version number to 2150 dated 23 August 2021, and to its malware removal tool MRT, bringing it to version 1.82, also dated 23 August 2021. These are the first security data updates since 28 June 2021.

Apple doesn’t release information about what these updates add or change, and obfuscates the identities of malware detected by XProtect using internal code names.

Changes found in the XProtect Yara definitions include the addition of one new signature for MACOS.7c241b4 (Adload/Climpi), replacement of MACOS.ef3df25 (Bundlore script) with MACOS.f5d33c9, replacement of MACOS.a9ea9b4 (Bundlore) with MACOS.8a20735 and changes in their signatures, and changes to the signature of MACOS.2afe6bd (Adload).

You can check whether this update has been installed by opening System Information via About This Mac, and selecting the Installations item under Software.

A full listing of security data file versions is given by SilentKnight, LockRattler and SystHist for El Capitan, Sierra, High Sierra, Mojave, Catalina and Big Sur, available from their product page. If your Mac has not yet installed this update, you can force an update using SilentKnight, LockRattler, or at the command line.

I have updated the reference pages here which are accessed directly from LockRattler 4.2 and later using its Check blog button.

I maintain lists of the current versions of security data files for Big Sur on this page, Catalina on this page, Mojave on this page, High Sierra on this page, Sierra on this page, and El Capitan on this page.

I am grateful to Phil Stokes at Sentinel Labs for decoding of the obfuscated malware names here, and to Stuart Ashenbrenner at Jamf for identifying the new addition.

Postscript

Some users are reporting that certain old apps, including those from Citrix, RSA, Cisco and Pulse, stop working after installing these updates. This is because those apps rely somewhere on code signed against the Symantec CA, which is no longer trusted by Apple (and hasn’t been for some time). If one of these apps stops working on your Mac, you’ll need to refer to its vendor for an update which no longer relies on the untrusted Symantec CA. Until then, that app will be flagged as malware, and should be removed.