Rootkits for Mac—do they exist?

It might be surprising to some people, but rootkits targeting macOS do exist. One of the most notable examples in this category of threats is the Rubylin rootkit. Among its features is the ability to hide files, directories, and processes, as well as users and ports from particular tools. Most of the techniques used in this case are different implementations of the approaches that we covered in Chapter 6, Understanding Kernel-Mode Rootkits dedicated to Windows kernel-mode threats, but this time for XNU kernel. As there are no real notorious malware families that extensively use these techniques for evil purposes, it falls outside the scope of this book. If you're curious, you can find more information about its internals by reading the Phrack article, Revisiting Mac OS X Kernel Rootkits, in issue 69.