SE Labs Test Shows Why Macs Need Third-Party Protection Against Targeted Attacks

SE Labs, the cyber security testing authority, announced today that its macOS Home Anti-Malware comparitive test found Bitdefender, ESET, Norton 360 and TotalAV Premium stopped all eleven targeted attacks. In stark contrast, macOS with its built-in security features turned on and Canimaan Software ClamXAV allowed targets to be compromised in every scenario.

The test used spear-phishing emails as the entry point for targeted attacks. In keeping with its Test Like Hackers™ approach, once control was established, SE Labs’ testers followed a playbook of actions commonly used by attackers. This included gathering system information, stealing files, spying on the network, destroying and encrypting data as a ransomware attacker would, and attempting to hide their tracks.

Some of these tasks required privilege escalation, which testers were able to achieve when no third-party real-time protection was in place. The results demonstrate the importance of effective anti-malware protection against targeted attacks.

“The danger is the gap between perception and reality. There’s still a widespread belief that Macs are inherently safe from serious attacks, but our latest test shows why that assumption can be dangerous,” comments Simon Edwards, CEO and founder of SE Labs. “The encouraging result is that good Mac security software made an enormous difference. But users must ensure that real-time protection is included in whatever product they choose. It’s a crucial component of a good security system.”

The test results sit within a broader problem for Mac users – a persistent perception that Macs are inherently secure, alongside an increase in targeted attacks and attacker tooling aimed at macOS.

For example, ClamXAV’s website claims that it will “Protect your Mac without slowing it down.” It doesn’t explicitly mention hacker attacks, but it does claim to protect files, privacy and to “Keep cyber criminals away.” While Apple does not make overt promises about preventing malware and similar threats, its messaging strongly implies that the platform is secure. The headline of its security page is “Security. Built right in.”

At the same time, targeted attacks against Macs are increasing. As enterprise use of Macs grows, so does the interest from threat groups targeting them, alongside the development of tools designed to make attacks easier. Atomic macOS Stealer (AMOS), Poseidon and Banshee are among the infostealers considered a growing threat. Threat actors including the North Korean group Sapphire Sleet have also used techniques that trick users into downloading malicious versions or updates of legitimate software.

As SE Labs’ report shows, the built-in protections tested with macOS were not sufficient to defend against these targeted attacks, while four third-party anti-malware products stopped all 11.

In SE Labs’ analysis, Bitdefender Antivirus for Mac, ESET Home Security Essential, Gen Digital Norton 360 and TotalAV Premium all achieved 100% Protection Accuracy. Canimaan Software ClamXAV and macOS both scored -125%, reflecting penalties applied for each failed attack.

The complete Security Evaluation Test Report: macOS Home Anti-Malware is available for free download on SE Labs’ website.