{"id":46465,"date":"2015-09-24T10:15:36","date_gmt":"2015-09-24T17:15:36","guid":{"rendered":"http:\/\/www.intego.com\/mac-security-blog\/?p=46465"},"modified":"2026-07-01T04:09:51","modified_gmt":"2026-07-01T11:09:51","slug":"apple-updates-xprotect-definitions-for-xcodeghost-malware","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/apple-updates-xprotect-definitions-for-xcodeghost-malware\/","title":{"rendered":"Apple Updates XProtect Definitions for XcodeGhost Malware"},"content":{"rendered":"

Apple has updated its XProtect.plist definitions file to version 2068, providing OS X with basic detection for the XcodeGhost malware and a new version of Genieo. This update detects two new variants of malware: OSX.XcodeGhost.A and OSX.Genieo.D.<\/p>\n

The XcodeGhost malware<\/a> is a fake version of Apple’s Xcode developer tool, which enabled hackers to put malicious code into apps available on the App Store.<\/p>\n

\"OSX.XcodeGhost.A<\/p>\n

Apple also added a new code to XProtect for OSX.Genieo.D, blocking the new variant of a\u00a0problematic adware installer. Genieo\u00a0is a troubling installer package<\/a> that surreptitiously delivers sketchy adware to people trying to install popular applications.<\/p>\n

\"OSX.Genieo.D<\/p>\n

Apple’s XProtect \u2014 its “safe downloads list” feature\u00a0\u2014\u00a0has been part of OS X since Snow Leopard; in 2009, Intego described\u00a0what this\u00a0anti-malware function does to protect your Mac<\/a>\u00a0(and how\u00a0it lacks protection). XProtect is the same function Apple uses to block out-of-date plug-ins for Flash Player<\/a> and Java, both of which are often targeted by malicious folks\u00a0looking to exploit vulnerabilities.<\/p>\n

Security updates from Apple are always welcome, however, XProtect only offers rudimentary protection against specific Mac threats:\u00a0it does not offer live malware scanning, nor does it protect\u00a0against Windows threats or phishing attacks, and it lacks the layered protection that full-featured Mac anti-virus software<\/a>\u00a0can provide.<\/p>\n","protected":false},"excerpt":{"rendered":"

Apple has updated its XProtect.plist definitions file to version 2068, providing OS X with basic detection for the XcodeGhost malware and a new version of Genieo. This update detects two new variants of malware: OSX.XcodeGhost.A and OSX.Genieo.D. The XcodeGhost malware is a fake version of Apple’s Xcode developer tool, which enabled hackers to put malicious […]<\/p>\n","protected":false},"author":4,"featured_media":46480,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[190,5],"tags":[3151,475,2488,2491,2479,303],"class_list":["post-46465","post","type-post","status-publish","format-standard","has-post-thumbnail","category-malware","category-security-news","tag-apple","tag-genieo","tag-osx-genieo-d","tag-osx-xcodeghost-a","tag-xcodeghost","tag-xprotect"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t