McAfee Report: Mac malware instances grew 744% in 2016 to 450K+, mostly from adware bundling, and IoT devices were used for the first time with Dyn
here's what to watch out for Juli Clover / MacRumors : Malware Attacks on Macs Up 744% in 2016, Mostly Due to Adware Christopher Baugh / iPhone in Canada Blog : Mac Malware Attacks Explode 744% in 2016, Mostly Due to Adware Ben Lovejoy / 9to5Mac : Mac malware grew 744% in 2016, says McAfee report, but most of it is adware Gabriela Vatu / Softpedia News : McAfee Report: Mac Malware Grew 744%, Most Is Adware Sam Pudwell / Silicon UK : McAfee Labs Report Lays Bare Threat Intelligence Challenges Facing Businesses Mike Wehner / BGR : Mac malware grew an astounding 744% in 2016, but that's actually not bad news AJ Dellinger / International Business Times : Mac Malware: McAfee Reports Huge Increase In Malware On MacOS Killian Bell / Cult of Mac : Mac malware skyrockets 744 percent in 2016 Tweets: Seamus / @seamusphan : And you wonder why people use adblocking? http://twitter.com/... Mike Hinshaw / @roothawg : What once was little problem for Mac Os, no longer holds true. http://twitter.com/...
Context & Ripple Effects
McAfee Labs' 2016 tally of 450,000+ Mac malware instances — up 744% year over year — was the moment macOS stopped being a statistical afterthought in threat reports, with adware bundling rather than sophisticated attacks doing most of the work. The same report marked the first time IoT devices were enlisted in an attack, against DNS provider Dyn.
Subsequent coverage validated the trajectory the report flagged: by 2019 Malwarebytes was detecting 11 threats per endpoint on Macs versus 5.8 on PCs, Kaspersky found ~30% of macOS detections traced to the Shlayer trojan spread through fake app installs, and researchers later caught adware slipping through Apple's own notarization process.
First-order effects
- Mac users became a viable monetization target for adware distributors almost overnight, with bundled-install schemes rather than exploits accounting for the bulk of the 744% growth.
- Security vendors like McAfee gained a new reporting franchise on macOS threats, and enterprise buyers had to start treating Mac fleets as endpoints requiring the same telemetry as Windows machines.
Second-order effects
- Apple was pushed into gatekeeping responses that escalated over the following years — from revoking developer certificates against Silver Sparrow to shutting down notarized adware campaigns — turning its signing pipeline into the primary malware battleground.
- Adware operators leaned harder on distribution tricks (fake installers, malvertising) instead of technical exploits, a pattern Malwarebytes later quantified with 77% of malvertising ad accounts used just once.
Third-order effects
- The 'Macs don't get malware' assumption structurally eroded: per-endpoint threat data eventually showed Macs outpacing PCs, forcing Apple to treat platform security as a continuous operational function rather than a design property.
- If adware economics keep favoring low-sophistication volume attacks, the industry splits into a cat-and-mouse over app distribution channels — certificates, notarization, ad networks — rather than traditional antivirus signatures.
The trend: Mac malware is maturing from a curiosity into a volume adware business, with Apple's app-signing and notarization infrastructure becoming the main chokepoint where the fight gets decided.