{"id":102778,"date":"2025-01-10T14:23:23","date_gmt":"2025-01-10T22:23:23","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=102778"},"modified":"2025-01-10T14:23:23","modified_gmt":"2025-01-10T22:23:23","slug":"the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/","title":{"rendered":"The Mac and iPhone malware of 2024\u2014and what to expect in 2025"},"content":{"rendered":"<p><img loading=\"lazy\" class=\"aligncenter size-full wp-image-102776\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/01\/2024-apple-year-in-malware-review-600x300-1.jpg\" alt=\"\" width=\"600\" height=\"300\" \/><\/p>\n<p>In a recent article, we reflected on the <a href=\"https:\/\/www.intego.com\/mac-security-blog\/apple-security-and-privacy-in-2024-the-year-in-review\/\">top security and privacy news that impacted the Apple ecosystem in 2024<\/a>. Today, it&#8217;s time to review <strong>the most notable Mac malware and iPhone malware campaigns<\/strong> of the past year\u2014and even what could be considered <strong>the first Apple Vision Pro malware<\/strong>. We&#8217;ll also forecast what we can expect to see more of in 2025.<\/p>\n<p>In this article:<\/p>\n<ul>\n<li><a href=\"#chron\">A chronological overview at 2024&#8217;s Mac and iPhone malware, by month<\/a><\/li>\n<li><a href=\"#forecast\">Malware forecast for 2025<\/a><\/li>\n<li><a href=\"#learnmore\">How can I learn more?<\/a><a name=\"chron\"><\/a><\/li>\n<\/ul>\n<h3>Mac malware and iPhone malware chronology of 2024<\/h3>\n<p>Following are some notable events in macOS, iOS, and visionOS malware in 2024, broken down by month.<\/p>\n<h4><strong>January<\/strong><\/h4>\n<ul>\n<li><a href=\"https:\/\/objective-see.org\/blog\/blog_0x78.html\" target=\"_blank\" rel=\"noopener nofollow\">SpectralBlur, a backdoor linked to North Korean threat actors, was discovered<\/a><\/li>\n<li><a href=\"https:\/\/objective-see.org\/blog\/blog_0x7D.html#-zuru2\" target=\"_blank\" rel=\"noopener nofollow\">A new variant of the ZuRu backdoor was discovered in pirated Mac apps<\/a><\/li>\n<li><a href=\"https:\/\/www.intego.com\/mac-security-blog\/atomic-stealer-amos-mac-malware-spreads-via-malicious-google-ads\/\">Atomic macOS Stealer (AMOS) spread via poisoned Google Ads<\/a><\/li>\n<\/ul>\n<h4><strong>February<\/strong><\/h4>\n<ul>\n<li><a href=\"https:\/\/www.intego.com\/mac-security-blog\/apple-is-distributing-a-fake-lastpass-password-manager-in-the-app-store\/\">Apple allowed a fake LastPass app called &#8220;LassPass&#8221; into the App Store<\/a>; it was an iOS and iPadOS compatible app that could also run on macOS and visionOS; it&#8217;s therefore the first-ever malware for Apple Vision Pro, which debuted in February<\/li>\n<li><a href=\"https:\/\/www.intego.com\/mac-security-blog\/apple-distributed-fake-crypto-finance-apps-in-app-store-leading-to-100k-losses\/\">Apple allowed two fraudulent crypto apps into the App Store<\/a>, mimicking Curve Finance and Rabbit Wallet; this reportedly led to more than $100K in stolen cryptocurrency<\/li>\n<li><a href=\"https:\/\/objective-see.org\/blog\/blog_0x7D.html#-pystealer\" target=\"_blank\" rel=\"noopener nofollow\">PyStealer, Python-based stealer malware, was discovered<\/a>, pretending to be a legitimate Mac app<\/li>\n<\/ul>\n<h4><strong>March<\/strong><\/h4>\n<ul>\n<li><a href=\"https:\/\/www.intego.com\/mac-security-blog\/apple-let-a-movie-piracy-app-reach-2-in-entertainment-in-the-u-s-app-store\/\"><span style=\"font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen-Sans, Ubuntu, Cantarell, 'Helvetica Neue', sans-serif;\">Apple allowed yet another fake cryptocurrency app, into the App Store<\/span><\/a>, this time mimicking PancakeSwap<\/li>\n<li><span style=\"font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen-Sans, Ubuntu, Cantarell, 'Helvetica Neue', sans-serif;\"><a href=\"https:\/\/www.intego.com\/mac-security-blog\/apple-let-a-movie-piracy-app-reach-2-in-entertainment-in-the-u-s-app-store\/\">An unethical app designed for movie piracy reached #2 in Entertainment in the U.S. App Store<\/a>; this was a potentially unwanted app (PUA\/PUP) from an unscrupulous developer, and may not have contained malware-like functionality; however, it demonstrated how careless Apple&#8217;s reviewers can be, and how Apple can directly profit from in-app purchases in criminal apps<\/span><\/li>\n<\/ul>\n<h4><strong>April<\/strong><\/h4>\n<ul>\n<li><a href=\"https:\/\/www.intego.com\/mac-security-blog\/cloudchat-infostealer-mac-malware-masquerades-as-safe-service\/\">Stealer malware functionality was found embedded in CloudChat<\/a>, a messaging app for Mac<\/li>\n<li><a href=\"https:\/\/objective-see.org\/blog\/blog_0x7D.html#-lightspy\" target=\"_blank\" rel=\"noopener nofollow\">A new macOS variant of the LightSpy iOS implant was discovered<\/a><\/li>\n<li><a href=\"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-new-atomic-stealer-amos-mac-malware-variants\/\">Intego discovered several new AMOS stealer malware variants<\/a>; these masqueraded as apps called File Juicer, Debit &amp; Credit, an NFT trading card game called Parallel, and Notion<\/li>\n<\/ul>\n<h4><strong>May<\/strong><\/h4>\n<ul>\n<li><a href=\"https:\/\/www.intego.com\/mac-security-blog\/intego-discovers-new-cuckoo-mac-malware-mimicking-homebrew\/\">Cuckoo AMOS malware masqueraded as Homebrew<\/a>; Intego quickly discovered previously undocumented variants after the initial report surfaced<\/li>\n<\/ul>\n<h4><strong>June<\/strong><\/h4>\n<ul>\n<li><a href=\"https:\/\/www.intego.com\/mac-security-blog\/intego-malware-discovery-fake-arc-browser-with-unique-applescript-component\/\">Intego discovered a Trojan horse masquerading as Arc<\/a>, the Web browser; this was an AMOS variant that included a unique AppleScript malware component<\/li>\n<li><a href=\"https:\/\/www.intego.com\/mac-security-blog\/chrome-extensions-are-a-security-nightmare-heres-why-you-should-avoid-them\/\">Google admitted that nearly 1 in every 100 installations of Chrome browser extensions contains malware<\/a>; not all of these malware threats necessarily impact Macs<\/li>\n<li><a href=\"https:\/\/www.intego.com\/mac-security-blog\/poseidon-macos-malware-employs-new-tricks-targets-swiss-mac-users\/\">Poseidon infostealer malware also masqueraded as Arc, as well as AGOV Access<\/a>\u2014an app claiming to be affiliated with the Swiss government<\/li>\n<\/ul>\n<h4><strong>July<\/strong><\/h4>\n<ul>\n<li><a href=\"https:\/\/www.intego.com\/mac-security-blog\/beavertail-and-invisibleferret-malware-target-job-seeking-mac-users\/\">BeaverTail and InvisibleFerret APT malware were discovered<\/a>; they were bundled with a Trojanized version of MiroTalk, a chat app<\/li>\n<\/ul>\n<h4><strong>August<\/strong><\/h4>\n<ul>\n<li><a href=\"https:\/\/www.intego.com\/mac-security-blog\/glowtime-apple-account-and-telegram-intego-mac-podcast-episode-359\/#:~:text=What%20is%20CthulhuStealer%20and%20ToDoSwift?\">CthulhuStealer malware-as-a-service surfaces<\/a> (<a href=\"https:\/\/objective-see.org\/blog\/blog_0x7D.html#-cthulhu\" target=\"_blank\" rel=\"noopener nofollow\">more info<\/a>)<\/li>\n<li><a href=\"https:\/\/www.intego.com\/mac-security-blog\/glowtime-apple-account-and-telegram-intego-mac-podcast-episode-359\/#:~:text=What%20is%20CthulhuStealer%20and%20ToDoSwift?\">TodoSwift, a Trojan horse for Mac disguised as a PDF<\/a>, was discovered and linked to North Korean hacking groups (<a href=\"https:\/\/thehackernews.com\/2024\/08\/new-macos-malware-todoswift-linked-to.html\" target=\"_blank\" rel=\"noopener\">more info<\/a>)<\/li>\n<li><a href=\"https:\/\/www.intego.com\/mac-security-blog\/mac-stealer-malware-market-surges-with-banshee-and-new-threat-actors\/\">Banshee Stealer, a new Mac stealer malware-as-a-service, was discovered<\/a><\/li>\n<li><a href=\"https:\/\/www.intego.com\/mac-security-blog\/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs\/\">HZ RAT, primarily known as Windows malware, was discovered to have a macOS variant<\/a><\/li>\n<\/ul>\n<h4><strong>September<\/strong><\/h4>\n<ul>\n<li><a href=\"https:\/\/x.com\/osint_barbie\/status\/1831085346374783081\" target=\"_blank\" rel=\"noopener\">Various macOS stealer<\/a> <a href=\"https:\/\/x.com\/osint_barbie\/status\/1840865672449995261\" target=\"_blank\" rel=\"noopener\">variants surfaced<\/a><\/li>\n<li><a href=\"https:\/\/x.com\/malwrhunterteam\/status\/1835992480744972496\" target=\"_blank\" rel=\"noopener\">A new RustBucket variant was discovered<\/a><\/li>\n<\/ul>\n<h4><strong>October<\/strong><\/h4>\n<ul>\n<li><a href=\"https:\/\/objective-see.org\/blog\/blog_0x7D.html#-notlockbit\" target=\"_blank\" rel=\"noopener nofollow\">NotLockbit, Mac ransomware designed to look like LockBit, was discovered<\/a><\/li>\n<\/ul>\n<h4><strong>November<\/strong><\/h4>\n<ul>\n<li><a href=\"https:\/\/www.intego.com\/mac-security-blog\/99-reasons-you-need-mac-antivirus-a-plethora-of-stealer-malware\/\">Intego reported on its discovery of over 99 unique samples of shell scripts<\/a> associated with AMOS malware<\/li>\n<li><a href=\"https:\/\/www.intego.com\/mac-security-blog\/tim-cook-on-retirement-the-fbi-on-encryption-and-chatgpt-on-forbidden-names-intego-mac-podcast-episode-373\/#:~:text=Open%20source%20game%20engine%20Godot%20spreads%20malware\">The Godot game engine was exploited to spread cross-platform malware<\/a>; 17,000 systems were reported to have been infected; although macOS and iOS are potential targets, reports did not specifically mention Apple operating systems as having been infected<\/li>\n<\/ul>\n<h4><strong>December<\/strong><\/h4>\n<ul>\n<li><span style=\"font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen-Sans, Ubuntu, Cantarell, 'Helvetica Neue', sans-serif;\"><a href=\"https:\/\/www.intego.com\/mac-security-blog\/mac-malware-masquerades-as-meeting-apps-realst-stealer-is-back\/\">Realst Stealer resurfaced, masquerading as videoconferencing apps<\/a> using names like Meetio and Meeten, backed by an elaborate distribution campaign<\/span><\/li>\n<li><a href=\"https:\/\/pooniawalla.github.io\/fake-fraudulent-scam-apps\/ios-app-store.html\" target=\"_blank\" rel=\"noopener\">As of December 31, 2024, there were about 300 known fraudulent apps (including fake loan apps) in the iOS App Store<\/a>; notably, this is based on only a single independent researcher&#8217;s volunteer work, which only focuses on Apple&#8217;s App Stores in eight countries, and does not focus on apps exclusively available in the macOS App Store<\/li>\n<\/ul>\n<p><span style=\"font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen-Sans, Ubuntu, Cantarell, 'Helvetica Neue', sans-serif;\">It&#8217;s important to note that the list above is just a small sampling of notable Apple malware that was reported publicly. Each month, Intego discovers and adds new detection for many, many new malware variants besides those that happen to get public write-ups.<\/span><a style=\"font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen-Sans, Ubuntu, Cantarell, 'Helvetica Neue', sans-serif;\" name=\"categ\"><\/a><a style=\"font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen-Sans, Ubuntu, Cantarell, 'Helvetica Neue', sans-serif;\" name=\"forecast\"><\/a><\/p>\n<h3>Malware forecast for 2025<\/h3>\n<p>Given the continued rise in <strong>stealer malware<\/strong> in 2024, and the lack of mitigations for such threats, we expect this trend to continue well into 2025. Evidently, this malware is profitable enough for malware developers that they have increasingly focused their efforts on it, more than other types of malware.<\/p>\n<p>As we recommended last year, browser makers should work together to identify better ways to safeguard browser data on the client side. And more importantly, Internet standards bodies should work with providers of Web services to validate that authentication cookies have not been stolen from a victim and reused by an attacker.<\/p>\n<p>Due to the lack of changes recently to Apple&#8217;s app review and vetting processes, we fully expect to continue to see more <strong>fraud apps in the App Store<\/strong>. A recent development is that iPhone and iPad apps may be distributed outside of the App Store in the EU, in order for Apple to comply with the Digital Markets Act (DMA); this means that sideloaded apps, and apps obtained through third-party app stores, <a href=\"https:\/\/www.intego.com\/mac-security-blog\/if-apple-allows-sideloading-in-ios-17-how-will-iphone-security-be-affected\/\">could potentially also be a new threat vector<\/a> through which PUA or malware could make its way onto iPhones and iPads.<\/p>\n<p>Each year we continue to see more macOS and iOS malware written by sophisticated and well-funded attack groups. And in 2024, there were once again reports about APT malware being discovered on targeted Apple users&#8217; devices. We fully anticipate observing more Mac-targeted and iPhone-targeted <strong>APT malware<\/strong> surfacing throughout 2025.<a name=\"staysafe\"><\/a><\/p>\n<h3>How can I keep my Mac safe from malware?<\/h3>\n<p><img loading=\"lazy\" class=\"alignright size-medium wp-image-54214\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2016\/06\/X9-Mac-Antivirus-Launch-300x150.png\" alt=\"Intego X9 software boxes\" width=\"200\" height=\"100\" srcset=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2016\/06\/X9-Mac-Antivirus-Launch-300x150.png 300w, https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2016\/06\/X9-Mac-Antivirus-Launch-150x75.png 150w, https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2016\/06\/X9-Mac-Antivirus-Launch.png 600w\" sizes=\"(max-width: 200px) 100vw, 200px\" \/>Intego VirusBarrier X9, included with <strong><a href=\"https:\/\/offer.intego.com\/BlogMACAV_lbmxlkchf\">Intego&#8217;s Mac Premium Bundle X9<\/a><\/strong>, can protect against, detect, and eliminate all of the malware covered in this write-up, and a lot more.<\/p>\n<p>If you believe your Mac may be infected, or to prevent future infections, it&#8217;s best to use antivirus software from a trusted Mac developer. VirusBarrier is award-winning antivirus software, designed by Mac security experts, that includes <a href=\"https:\/\/www.intego.com\/mac-security-blog\/why-your-antivirus-needs-real-time-scanning\/\">real-time protection<\/a>. It runs natively on both Intel- and Apple silicon-based Macs, and it&#8217;s compatible with Apple&#8217;s current Mac operating system, macOS Sonoma.<\/p>\n<p>If you use a Windows PC, <a href=\"https:\/\/www.intego.com\/lp\/route-podcast-intego\/?channel=Podcast_Intego&amp;lpx=buy\"><strong>Intego Antivirus for Windows<\/strong><\/a> can keep your computer protected from malware.<a name=\"learnmore\"><\/a><\/p>\n<h3>How can I learn more?<\/h3>\n<p>We discussed this topic on <a href=\"https:\/\/www.intego.com\/mac-security-blog\/mac-malware-in-2024-and-should-we-trust-cyber-trust-intego-mac-podcast-378\/\">episode 378<\/a> of the Intego Mac Podcast.<\/p>\n<p><iframe style=\"width: 100%; max-width: 660px; overflow: hidden; border-radius: 10px;\" src=\"https:\/\/embed.podcasts.apple.com\/us\/podcast\/episode-378-mac-malware-in-2024-and-should-we-trust\/id1293834627?i=1000683296165\" height=\"175\" frameborder=\"0\" sandbox=\"allow-forms allow-popups allow-same-origin allow-scripts allow-storage-access-by-user-activation allow-top-navigation-by-user-activation\"><\/iframe><\/p>\n<p>For additional details about some of the Mac malware of 2024, you can read <a href=\"https:\/\/objective-see.org\/blog\/blog_0x7D.html\" target=\"_blank\" rel=\"noopener nofollow\">Patrick Wardle&#8217;s<\/a> write-up.<\/p>\n<p><a href=\"https:\/\/podcast.intego.com\/\" target=\"_blank\" rel=\"noopener\"><img class=\"alignleft\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2021\/04\/intego-podcast-artwork-400.jpg\" alt=\"\" width=\"80\" \/><\/a>Each week on the <a href=\"https:\/\/podcast.intego.com\/\" target=\"_blank\" rel=\"noopener\"><strong>Intego Mac Podcast<\/strong><\/a>, Intego&#8217;s Mac security experts discuss the latest Apple news, including security and privacy stories, and offer practical advice on getting the most out of your Apple devices. Be sure to <a href=\"https:\/\/podcasts.apple.com\/us\/podcast\/intego-mac-podcast\/id1293834627\" rel=\"noopener\"><strong>follow the podcast<\/strong><\/a> to make sure you don\u2019t miss any episodes.<\/p>\n<p>You can also subscribe to our <a href=\"https:\/\/www.intego.com\/mac-security-blog\/mac-security-newsletter\/\"><strong>e-mail newsletter<\/strong><\/a> and keep an eye here on <a href=\"https:\/\/www.intego.com\/mac-security-blog\"><strong>The Mac Security Blog<\/strong><\/a> for the latest Apple security and privacy news. And don&#8217;t forget to follow Intego on your favorite social media channels: <a href=\"https:\/\/x.com\/IntegoSecurity\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow Intego on \ud835\udd4f\/Twitter\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/X-Twitter-logo-icon-225.gif\" alt=\"Follow Intego on X\/Twitter\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.facebook.com\/Intego\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow Intego on Facebook\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/Facebook-logo-icon-225.gif\" alt=\"Follow Intego on Facebook\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.youtube.com\/user\/IntegoVideo?sub_confirmation=1\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(0, 0, 0, 0.2); border-radius: 8px;\" title=\"Follow Intego on YouTube\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/YouTube-logo-icon-225.png\" alt=\"Follow Intego on YouTube\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.linkedin.com\/company\/intego\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow Intego on LinkedIn\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/LinkedIn-logo-icon-225.gif\" alt=\"Follow Intego on LinkedIn\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.pinterest.com\/intego\/\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(0, 0, 0, 0.2); border-radius: 8px;\" title=\"Follow Intego on Pinterest\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/Pinterest-logo-icon-225.png\" alt=\"Follow Intego on Pinterest\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.instagram.com\/intego_security\/\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow Intego on Instagram\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/Instagram-logo-icon-225.gif\" alt=\"Follow Intego on Instagram\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/podcasts.apple.com\/us\/podcast\/intego-mac-podcast\/id1293834627\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow the Intego Mac Podcast on Apple Podcasts\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2017\/10\/ios9-podcasts-app-tile.png\" alt=\"Follow the Intego Mac Podcast on Apple Podcasts\" width=\"16\" \/><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>From Mac to iPhone (and even Vision Pro), and from stealer malware to APTs, we review the major Apple malware of 2024. We also forecast what types of malware we can expect to see more of in 2025.<\/p>\n","protected":false},"author":14,"featured_media":102774,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[190],"tags":[1486,86,4722],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v17.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<meta name=\"description\" content=\"From Mac to iPhone (and even Vision Pro), and from stealer malware to APTs, we review the major Apple malware of 2024. We also forecast what types of malware we can expect to see more of in 2025.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The Mac and iPhone malware of 2024\u2014and what to expect in 2025 - The Mac Security Blog\" \/>\n<meta property=\"og:description\" content=\"From Mac to iPhone (and even Vision Pro), and from stealer malware to APTs, we review the major Apple malware of 2024. We also forecast what types of malware we can expect to see more of in 2025.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/\" \/>\n<meta property=\"og:site_name\" content=\"The Mac Security Blog\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/JoshLong\" \/>\n<meta property=\"article:published_time\" content=\"2025-01-10T22:23:23+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/01\/2024-apple-year-in-malware-review-400x260-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"400\" \/>\n\t<meta property=\"og:image:height\" content=\"260\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@theJoshMeister\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Joshua Long\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#organization\",\"name\":\"Intego\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/\",\"sameAs\":[],\"logo\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#logo\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png\",\"contentUrl\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png\",\"width\":875,\"height\":875,\"caption\":\"Intego\"},\"image\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#logo\"}},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#website\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/\",\"name\":\"The Mac Security Blog\",\"description\":\"Keep Macs safe from the dangers of the Internet\",\"publisher\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.intego.com\/mac-security-blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/#primaryimage\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/01\/2024-apple-year-in-malware-review-400x260-1.jpg\",\"contentUrl\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/01\/2024-apple-year-in-malware-review-400x260-1.jpg\",\"width\":400,\"height\":260,\"caption\":\"2024 Apple malware year in review and 2025 predictions\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/#webpage\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/\",\"name\":\"The Mac and iPhone malware of 2024\\u2014and what to expect in 2025 - The Mac Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/#primaryimage\"},\"datePublished\":\"2025-01-10T22:23:23+00:00\",\"dateModified\":\"2025-01-10T22:23:23+00:00\",\"description\":\"From Mac to iPhone (and even Vision Pro), and from stealer malware to APTs, we review the major Apple malware of 2024. We also forecast what types of malware we can expect to see more of in 2025.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.intego.com\/mac-security-blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The Mac and iPhone malware of 2024\\u2014and what to expect in 2025\"}]},{\"@type\":\"Article\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/#webpage\"},\"author\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/dcf592275ba6edde8d20f1e60029c6b1\"},\"headline\":\"The Mac and iPhone malware of 2024\\u2014and what to expect in 2025\",\"datePublished\":\"2025-01-10T22:23:23+00:00\",\"dateModified\":\"2025-01-10T22:23:23+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/#webpage\"},\"wordCount\":1179,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/01\/2024-apple-year-in-malware-review-400x260-1.jpg\",\"keywords\":[\"iOS Malware\",\"Malware\",\"Stealer Malware\"],\"articleSection\":[\"Malware\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/#respond\"]}]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/dcf592275ba6edde8d20f1e60029c6b1\",\"name\":\"Joshua Long\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#personlogo\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/5ad29f4111ce14911abaa98cbbcdea42?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/5ad29f4111ce14911abaa98cbbcdea42?s=96&d=mm&r=g\",\"caption\":\"Joshua Long\"},\"description\":\"Joshua Long (@theJoshMeister), formerly Intego\\u2019s Chief Security Analyst, is a renowned security researcher and writer, and an award-winning public speaker. Josh has a master\\u2019s degree in IT concentrating in Internet Security and has taken doctorate-level coursework in Information Security. Apple has publicly acknowledged Josh for discovering an Apple\\u00a0ID authentication vulnerability. Josh has conducted cybersecurity research for well over 25 years, which is often featured by major news outlets worldwide. Keep up with Josh via X\/Twitter, LinkedIn, Facebook, Instagram, YouTube, Patreon, Mastodon, the JoshMeister on Security, and more. \\u2014\",\"sameAs\":[\"https:\/\/security.thejoshmeister.com\",\"https:\/\/www.facebook.com\/JoshLong\",\"https:\/\/www.instagram.com\/thejoshmeister\/\",\"https:\/\/www.linkedin.com\/in\/thejoshmeister\",\"https:\/\/www.pinterest.com\/thejoshmeister\/\",\"https:\/\/twitter.com\/theJoshMeister\",\"https:\/\/www.youtube.com\/@theJoshMeister\"],\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/author\/joshlong\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"description":"From Mac to iPhone (and even Vision Pro), and from stealer malware to APTs, we review the major Apple malware of 2024. We also forecast what types of malware we can expect to see more of in 2025.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/","og_locale":"en_US","og_type":"article","og_title":"The Mac and iPhone malware of 2024\u2014and what to expect in 2025 - The Mac Security Blog","og_description":"From Mac to iPhone (and even Vision Pro), and from stealer malware to APTs, we review the major Apple malware of 2024. We also forecast what types of malware we can expect to see more of in 2025.","og_url":"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/","og_site_name":"The Mac Security Blog","article_author":"https:\/\/www.facebook.com\/JoshLong","article_published_time":"2025-01-10T22:23:23+00:00","og_image":[{"width":400,"height":260,"url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/01\/2024-apple-year-in-malware-review-400x260-1.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_creator":"@theJoshMeister","twitter_misc":{"Written by":"Joshua Long","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Organization","@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization","name":"Intego","url":"https:\/\/www.intego.com\/mac-security-blog\/","sameAs":[],"logo":{"@type":"ImageObject","@id":"https:\/\/www.intego.com\/mac-security-blog\/#logo","inLanguage":"en-US","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png","contentUrl":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png","width":875,"height":875,"caption":"Intego"},"image":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#logo"}},{"@type":"WebSite","@id":"https:\/\/www.intego.com\/mac-security-blog\/#website","url":"https:\/\/www.intego.com\/mac-security-blog\/","name":"The Mac Security Blog","description":"Keep Macs safe from the dangers of the Internet","publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intego.com\/mac-security-blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"ImageObject","@id":"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/#primaryimage","inLanguage":"en-US","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/01\/2024-apple-year-in-malware-review-400x260-1.jpg","contentUrl":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/01\/2024-apple-year-in-malware-review-400x260-1.jpg","width":400,"height":260,"caption":"2024 Apple malware year in review and 2025 predictions"},{"@type":"WebPage","@id":"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/#webpage","url":"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/","name":"The Mac and iPhone malware of 2024\u2014and what to expect in 2025 - The Mac Security Blog","isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/#primaryimage"},"datePublished":"2025-01-10T22:23:23+00:00","dateModified":"2025-01-10T22:23:23+00:00","description":"From Mac to iPhone (and even Vision Pro), and from stealer malware to APTs, we review the major Apple malware of 2024. We also forecast what types of malware we can expect to see more of in 2025.","breadcrumb":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.intego.com\/mac-security-blog\/"},{"@type":"ListItem","position":2,"name":"The Mac and iPhone malware of 2024\u2014and what to expect in 2025"}]},{"@type":"Article","@id":"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/#article","isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/#webpage"},"author":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/dcf592275ba6edde8d20f1e60029c6b1"},"headline":"The Mac and iPhone malware of 2024\u2014and what to expect in 2025","datePublished":"2025-01-10T22:23:23+00:00","dateModified":"2025-01-10T22:23:23+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/#webpage"},"wordCount":1179,"commentCount":0,"publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"},"image":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/01\/2024-apple-year-in-malware-review-400x260-1.jpg","keywords":["iOS Malware","Malware","Stealer Malware"],"articleSection":["Malware"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.intego.com\/mac-security-blog\/the-mac-and-iphone-malware-of-2024-and-what-to-expect-in-2025\/#respond"]}]},{"@type":"Person","@id":"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/dcf592275ba6edde8d20f1e60029c6b1","name":"Joshua Long","image":{"@type":"ImageObject","@id":"https:\/\/www.intego.com\/mac-security-blog\/#personlogo","inLanguage":"en-US","url":"https:\/\/secure.gravatar.com\/avatar\/5ad29f4111ce14911abaa98cbbcdea42?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/5ad29f4111ce14911abaa98cbbcdea42?s=96&d=mm&r=g","caption":"Joshua Long"},"description":"Joshua Long (@theJoshMeister), formerly Intego\u2019s Chief Security Analyst, is a renowned security researcher and writer, and an award-winning public speaker. Josh has a master\u2019s degree in IT concentrating in Internet Security and has taken doctorate-level coursework in Information Security. Apple has publicly acknowledged Josh for discovering an Apple\u00a0ID authentication vulnerability. Josh has conducted cybersecurity research for well over 25 years, which is often featured by major news outlets worldwide. Keep up with Josh via X\/Twitter, LinkedIn, Facebook, Instagram, YouTube, Patreon, Mastodon, the JoshMeister on Security, and more. \u2014","sameAs":["https:\/\/security.thejoshmeister.com","https:\/\/www.facebook.com\/JoshLong","https:\/\/www.instagram.com\/thejoshmeister\/","https:\/\/www.linkedin.com\/in\/thejoshmeister","https:\/\/www.pinterest.com\/thejoshmeister\/","https:\/\/twitter.com\/theJoshMeister","https:\/\/www.youtube.com\/@theJoshMeister"],"url":"https:\/\/www.intego.com\/mac-security-blog\/author\/joshlong\/"}]}},"jetpack_featured_media_url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/01\/2024-apple-year-in-malware-review-400x260-1.jpg","jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p4VAYd-qJI","amp_enabled":true,"_links":{"self":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/102778"}],"collection":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/comments?post=102778"}],"version-history":[{"count":4,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/102778\/revisions"}],"predecessor-version":[{"id":102782,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/102778\/revisions\/102782"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/media\/102774"}],"wp:attachment":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/media?parent=102778"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/categories?post=102778"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/tags?post=102778"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}