Today we know of over 236,000 malicious malware items. These are mostly meant for the MS-Windows environment. Only about 700 are meant for the various Unix/Linux distributions. Current known Mac OSX malware count is even less with 7, so pretty much non-existent at the moment. For older builds of the MacOS there are 69 known malicious items, with an additional 8 items for MacHC that used hypercard script extensions which had to be manually installed as an addon package.

Malware writers tend to write for systems that are the mostly widely used. With Microsoft Windows being dominant in the desktop market it is clear why the most malware is written for it. Also, prior to Vista, the various Windows versions were pretty much wide open, full access, making it relatively easy for malware to abuse.

The number of *nix malware might not be that big, but if we consider that a large number of E-mail and File servers actually run *nix versions, then the impact of successful *nix malware might be bigger then initially expected. The problem with *nix malware is that there are a lot of different flavors/distributions and kernel versions. ELF binary malware is highly susceptible to these variations and most times will fail to even run properly, resulting in segmentation faults etc. Many malware packages actually come with a set of scripts and have the viral source code in source files like .c embedded in the package and can perform local recompiles, with say gcc, as to enhance the chance of binaries running fine. Such packages are easy to spot but not so very successful when executed.

In fact there are open source implementations of .NET like the mono project. With that, the distribution/flavor/kernel version dependency is pretty much gone. But so far projects like mono have not integrated fully into popular distributions like Suse or Redhat. In fact there also exists support for the SunOS and Macintosh, so in the future this could be mis-used for malware.

Nowadays malware writers do not go for massive attacks but tend to focus on targeted attacks. This is more worrisome then the poor malicious demonstrators that the OSX threats of Leap and Macarena really represent. Nevertheless it is clear that OSX malware is not taking off yet. With an estimated OSX marketshare of about 5 % on the desktop systems one would expect to see more malware for OSX.

OSX is originally based on BSD. One shouldn’t run by default with root access so adding/modifying system binaries should, in theory, not be that easy to achieve. Nevertheless *nix rootkits do also exist, so a perfect guarantee can’t be given.

Also, on OSX systems, the source code is available for many components. This can make it easier for malware authors to write malicious code/exploits.

It’s hard to predict if the number of malware for OSX will remain very low or if it will increase significantly - so stay tuned!!