MacOS info-stealers quickly evolve to evade XProtect detection

SentinelOne's report highlights three macOS info-stealers — KeySteal, Atomic Stealer, and CherryPie — that actively evade detection by Apple's XProtect and many antivirus products through rapid evolution, anti-analysis techniques, and persistence mechanisms; they target Keychain credentials, can disable Gatekeeper, and employ anti-VM and obfuscation strategies. While Apple has updated some XProtect signatures, detection remains inconsistent, and the report recommends defenses beyond static signatures, including dynamic/heuristic AV, network monitoring, firewalls, and timely patching.