XProtect and MRT Updates for macOS.

Apple has just released major updates to XProtect, XProtect Remediator, YARA definitions, and Bastion Rules. (08-July-2025)

1. XProtect (XProtectPlistConfigData) has been updated to version 5304 as of 08-July-2025.
2. XProtect Remediator (XPR) (XProtectPayloads) remains at version 152 as of 08-July-2025.
3. The Malware Removal Tool (MRT) (MRTConfigData) has remained at version 1.93 since 16-September-2024.

Although periodically checked by macOS, manually running the following macOS Software Update Tool commands could hasten any of the above applicable pending software update(s) and activation:

Update(s) Check:

% softwareupdate -ia --include-config-data (macOS 10.15 Catalina through macOS 14.7 Sonoma)
% softwareupdate -ia --include-config-data && sudo xprotect update (macOS 15.0 to 15.1.1 Sequoia)
% sudo xprotect update && sudo xprotect update --prerelease (macOS 15.2 Sequoia and above)

Versions Check:

% defaults read /Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist CFBundleShortVersionString; defaults read /Library/Apple/System/Library/CoreServices/XProtect.app/Contents/Info.plist CFBundleShortVersionString; defaults read /Library/Apple/System/Library/CoreServices/MRT.app/Contents/Info.plist CFBundleShortVersionString

% sudo xprotect check && xprotect version && xprotect status (macOS 15.x Sequoia)

 

What happened to XProtect this week?

This week’s security data updates were quite a surprise. We’ve grown accustomed to Apple tweaking XProtect’s data most weeks, but this week was a bit different and came with an update to XProtect Remediator as well, the first in four months. This article explores what they have brought.

Although this security data all goes under the name of XProtect, there are three different protection systems involved.

More…

 

Apple has just released updates to XProtect and YARA definitions.. (15-July-2025)

1. XProtect (XProtectPlistConfigData) has been updated to version 5305 as of 15-July-2025.
2. XProtect Remediator (XPR) (XProtectPayloads) remains at version 152 as of 08-July-2025.
3. The Malware Removal Tool (MRT) (MRTConfigData) has remained at version 1.93 since 16-September-2024.

Although periodically checked by macOS, manually running the following macOS Software Update Tool commands could hasten any of the above applicable pending software update(s) and activation:

Update(s) Check:

% softwareupdate -ia --include-config-data (macOS 10.15 Catalina through macOS 14.7 Sonoma)
% softwareupdate -ia --include-config-data && sudo xprotect update (macOS 15.0 to 15.1.1 Sequoia)
% sudo xprotect update && sudo xprotect update --prerelease (macOS 15.2 Sequoia and above)

Versions Check:

% defaults read /Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist CFBundleShortVersionString; defaults read /Library/Apple/System/Library/CoreServices/XProtect.app/Contents/Info.plist CFBundleShortVersionString; defaults read /Library/Apple/System/Library/CoreServices/MRT.app/Contents/Info.plist CFBundleShortVersionString

% sudo xprotect check && xprotect version && xprotect status (macOS 15.x Sequoia)