Running with full security enabled, macOS successfully recognised and blocked the samples of CloudMensis and XCSSET, whether or not a quarantine flag was set. To further aid the malware, tests were also run in each VM with the quarantine flag stripped from Zip archives. As some of the samples lacked an effective installer, and macOS 13.1 has patched most if not all the vulnerabilities they relied on to install successfully, only the XCSSET and DazzleSpy samples appeared able to run and at least partially install themselves.

Samples tested included DazzleSpy, SysJoker, CloudMensis (known by Apple as SnowDrift) and XCSSET (identified by Apple as DubRobber A). Because the malware samples include x86 executables, Rosetta 2 was installed on each VM before testing started. Settings were confirmed by checking each with SilentKnight, and all tests were virtualised using sandboxed ViableS locked down in isolation from the host Mac Studio M1 Max. Permissive Security with SIP disabled, and the security assessment policy subsystem disabled using spctl -global-disable.Permissive Security set in Recovery mode, with System Integrity Protection (SIP) disabled.Apple silicon Full Security mode, with all standard security protection enabled.To investigate this, I prepared three Ventura 13.1 virtual machines, each with different security configurations:

In this article I set out to assess how good Ventura 13.1 is when confronted with real malware.

It’s one of the commonest questions I’m asked: can an ordinary Mac user now rely on the security protection provided by macOS Ventura, or do they need third-party extras? The correct answer is that it depends on your security risk assessment, but you also need to know how effective macOS protection is, and where its weaknesses are.

Best mac malware removal os sierra