A text command pasted into the terminal isn't a binary.
Convincing a Linux user to paste rm -rf / into the terminal is not malware. It's social engineering.
Scanning binaries for known malware is already built into the OS.
Convincing a Linux user to paste rm -rf / into the terminal is not malware. It's social engineering.
Scanning binaries for known malware is already built into the OS.
Gatekeeper and Xprotect are good, but there's only so much they can do.
The screenshots from the article clearly show a permission prompt for a program. Whether that's a binary or a shell script or something else doesn't matter, the infection stage should've been caught by anti malware rather than permission prompts.
Windows Defender does this already. If Apple's AV can't catch this, I think they may be relying on their DRM-as-a-security-measure (signatures, notarisation, etc.) a bit too much.
Clearly it isn't. XProtect is a joke. It's 2004-era ClamAV level of protection.
In this case, the user is warned that the command wants to do something dangerous and must manually allow or deny the action.