Macs face nearly twice as many online threats as Windows PCs (report)

Two iMac models on sale in a retail store.
(Image credit: Woraphong Suphutayothin/Shutterstock)

Macs encountered nearly twice as many threats as did Windows PCs in 2019, antivirus/antispyware maker Malwarebytes said today (Feb. 11), citing data collected from machines with its software installed.

"In 2019, we detected an average of 11 threats per Mac endpoint," said the Malwarebytes 2020 State of Malware Report, "nearly double the average of 5.8 threats per endpoint on Windows."

Granted, most of the Mac threats were adware and other potentially unwanted programs (PUPs), which are often just annoying and rarely merit being called truly malicious. There are more Windows threats overall, but they're divided among many more Windows users.

Yet the numbers confirm what some experts have long suspected: Mac users see more adware than Windows users. And it's getting worse. 

Malwarebytes said that Macs running its software saw an average of only 4.8 threats in all of 2018, less than half the average of 2019. If you're on a Mac, make sure you're running one of the best Mac antivirus programs.

With great growth comes greater responsibility

Part of that growth may be because the Mac share of the overall desktop OS market increased dramatically in 2019, per StatCounter figures -- from 12.3% to 17% worldwide, and from 18.5% to 25.5% in North America. That rapid growth makes developing malware and adware for Macs worthwhile.

But another reason, the Malwarebytes report says, is because "macOS' built-in security systems have not cracked down on adware and PUPs to the same degree that they have malware, leaving the door open for these borderline programs to infiltrate."

Sick PUPpies

Two Mac PUPs called NewTab and PCVARK were Nos. 2 and 3 in the most detected strains of unwanted software across all platforms. (The No. 1 threat was a strain of Windows adware.) 

NewTab is adware that piggybacks on Safari extensions and redirects search results to links in which its managers have some financial interest. 

PCVARK is Malwarebytes' term for a family of "scareware" and "cleaners" that tries to convince users that their Macs are infected or clogged with junk and must buy PCVARK's software to remedy the situation.

By contrast, the top-ranked strain of Mac malware wasn't a single strain at all, yet was the No. 30 most frequently encountered Mac threat in 2019.

"When it comes to traditional Mac malware, such as backdoors, cryptominers, and spyware, the list is topped in 2019 by a group of files exhibiting similar malicious behavior, detected with a generic moniker: OSX.Generic.Suspicious," Malwarebytes said. 

Windows malware is still way worse

These threats run unauthorized code out of the user's sight, Malwarebytes said. But they're nothing compared to the threats Windows users face. 

Not only do Windows users get to see many of the same adware strains and PUPs that Mac users encounter, but they have to deal with truly terrible malware like the Emotet and TrickBot Trojans and the Ryuk and Sodinokibi ransomware strains.

"TrickBot and Emotet surfaced in the top five threats for nearly every region of the globe," Malwarebytes wrote. "Ryuk detections increased by 543 percent over Q4 2018, and since its introduction in May 2019, detections of Sodinokibi have increased by 820 percent."

The one saving grace for consumers is that these strains target businesses more frequently than consumers, with Ryuk responsible for attacking hospitals and other medical facilities worldwide. 

But consumers aren't immune: Emotet sent out poisoned holiday emails at the end of 2019, and now is capitalizing on the Wuhan coronavirus to get people to open booby-trapped attachments.

Paul Wagenseil

Paul Wagenseil is a senior editor at Tom's Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-haul driver, code monkey and video editor. He's been rooting around in the information-security space for more than 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown up in random TV news spots and even moderated a panel discussion at the CEDIA home-technology conference. You can follow his rants on Twitter at @snd_wagenseil.