Help, there’s a Mac on my network (8): shouldn’t it have antivirus?

Episode 8 of the series Help, there’s a Mac on my network.

What happened

Marieke’s email had the subject line “quick one to fill in?” and a 14 page questionnaire attached. The cyber insurance was up for renewal. Ruud made coffee, picked up his mug (“Have you tried turning it off and on again?”) and got going. MFA: yes. Backups: yes, offline copy too. Patch policy: yes. Then came question 23: “Is antivirus or EDR installed and centrally managed on all endpoints?”

Ruud was about to tick the box. Every Windows laptop runs Defender, neatly hooked up to Intune. Then he thought of Marieke’s MacBook Air. And of the three Macs that had joined it since, because Marieke had shared her good feeling with the planning department.

“Sam, what are those Macs actually running for antivirus?”

Sam looked up from his screen. “Nothing, right? Macs don’t get viruses, do they?”

There was a short silence. Ruud put his mug down very slowly. “That,” he said, “is exactly what I said about my Windows XP machine in 2003. Two days later I had Blaster.”

“Okay, okay,” said Sam. “That was half a joke. But a Mac isn’t exactly naked out of the box either. Can I just?” He pulled up a chair and started listing. XProtect. Gatekeeper. Notarization. SIP. A sealed system volume. FileVault. Ruud wrote along on the back of the questionnaire and had to admit it was more than he had expected.

“Nice,” said Ruud. “Now the important part. Where do I see all of that? Because the insurer isn’t asking whether it’s there. They’re asking whether we can prove it.”

For once Sam didn’t have an answer ready. “Fair point,” he said. “That one’s yours.”

What’s really going on

They are both a little bit right, and that is the honest answer to the question.

A Mac is well protected on its own. There is more built in than most Windows admins assume:

• XProtect is the built-in malware scanner in macOS. It checks apps for known malware using signatures that Apple updates separately from regular macOS updates.
• XProtect Remediator scans periodically in the background, mostly when the Mac is awake but not doing much, and cleans up known malware that is already on the system.
• Gatekeeper and notarization: apps from outside the App Store must be signed with a Developer ID and checked by Apple. Since macOS Sequoia you can no longer launch a blocked app with Control-click and Open. You now have to go through System Settings, Privacy & Security, Open Anyway.
• System Integrity Protection (SIP) and the signed system volume: the system files live on a read-only volume that is cryptographically sealed. Even with admin rights you can’t just change them.
• FileVault encrypts the disk. If someone leaves their MacBook on the train, the data stays unreadable.

But Macs do get malware. The biggest threat isn’t a classic self-spreading virus, it’s the infostealer. Atomic macOS Stealer, AMOS for short, is rented out to criminals as a service and has been the best known one for years. A stealer grabs browser passwords, session cookies, the keychain and crypto wallets, and is often gone again shortly after. Attackers then use those stolen session cookies to sign in to your Microsoft 365 tenant.

How does it get on there? Almost always because the user helps. Through an ad for a “free” version of a popular app, a fake installer on a lookalike site, or the trick called ClickFix: a fake CAPTCHA that asks you to paste a command into Terminal “to prove you’re not a robot”. Several of these campaigns were documented in 2026, by Microsoft, Jamf and Palo Alto Networks’ Unit 42 among others, where AMOS was pulled in through Terminal or even Script Editor. Apple added a warning in macOS Tahoe 26.4 when you paste a suspicious command into Terminal, but it isn’t officially documented and the user can simply click past it.

And then there’s the questionnaire. An insurer, an auditor or the NIS2 rules (in the Netherlands, the Cyberbeveiligingswet) don’t want to hear that something is “on by default”. They want evidence: which device, which status, which alerts, and who responds when something happens. XProtect does its job, but it reports nothing to your console. For that you need EDR. Whether your company falls under NIS2 itself depends on sector and size, but your larger clients might, and they ask their suppliers the same questions.

How to fix it

1. Put Microsoft Defender for Endpoint on the Macs

If you already have Defender for Windows, through Microsoft 365 Business Premium (which includes Defender for Business) or through Defender for Endpoint Plan 1 or 2, you can use that licence for macOS as well. Defender supports the three most recent macOS versions: right now that’s Golden Gate (27), Tahoe (26) and Sequoia (15). Rolling it out with Intune goes like this:

1. Connect Defender and Intune (one time, in the Intune admin center under Endpoint security).
2. Create a settings catalog profile that approves the system extensions: com.microsoft.wdav.epsext and com.microsoft.wdav.netext, team ID UBF8T346G9, types Network and EndpointSecurity.
3. Deploy the network filter profile (netfilter.mobileconfig from Microsoft’s mdatp-xplat GitHub repo). Note: macOS only supports one network filter profile. If you already run another web filter, test first.
4. Grant Full Disk Access with a PPPC profile (fulldisk.mobileconfig). Deployed through MDM, the user can’t switch it off again.
5. Add the profiles for background services (background_services.mobileconfig) and notifications (notif.mobileconfig).
6. Create an antivirus and EDR policy for macOS.
7. Only then publish the app (Intune has an app type specifically for Defender on macOS) and the onboarding package from the Defender portal.

Check on the Mac with mdatp health in Terminal. If healthy says true and the Mac shows up in the Defender portal, you can tick that box with a clear conscience.

2. Enforce the built-in protection

• FileVault on through an Intune policy, with the recovery key stored in Intune. Same reason you don’t want BitLocker keys on a sticky note.
• Firewall: the macOS application firewall is off by default. Turn it on with a macOS firewall policy in Intune, and add stealth mode.
• Updates: have security responses and system data files install automatically, so XProtect stays current.
• No everyday admin accounts. A standard user can break a lot less, even when they do click on something.

3. Tell your users

The best scanner in the world can’t stop someone who pastes a command into Terminal themselves. One line in the internal newsletter works wonders: “A website will never ask you to paste something into Terminal. If one does, call Ruud.”

Ruud’s lesson

“Macs don’t get viruses” is the same kind of sentence as “I’ve never had a flat tyre”. True, right up until it isn’t. The Mac has very good locks on the door, there’s just no camera you can play back. Sam knew which locks were fitted, I knew who wanted to see the footage. Together we filled in question 23 in one afternoon. Honestly, which is the main thing.

Further reading: Apple Business, Entra ID and Intune for small businesses and a Mac in a Windows network.

This is episode 8 of Help, there’s a Mac on my network. Need help with Macs in your organisation? Email frank@analystict.nl.