// Comparison

The Art of Mac Malware, Volume 1 vs The Art of Mac Malware, Volume 2: Which Should You Read?

Two cybersecurity books on Malware, compared honestly: who each is for, what each does best, and which to read first.

Advanced

4/52022

The Guide to Analyzing Malicious Software

Patrick Wardle

Patrick Wardle's deep dive on macOS malware analysis: persistence patterns, injection techniques, anti-analysis tricks, and the macOS-specific tooling needed to triage real samples.

Advanced

4/52025

The Art of Mac Malware, Volume 2

Detecting Malicious Software

Patrick Wardle

The detection-focused sequel to Volume 1, Wardle turns from analyzing Mac malware to building the heuristics and tooling that catch it, using macOS's security frameworks and real-world malware samples throughout.

Read this if

Malware analysts who need to handle macOS samples and have so far worked Windows-only. The only serious book in print on Mac malware, by the most prominent practitioner in the field.

Detection engineers and blue teamers who already have Volume 1's analysis grounding and now need to build detections, not just read samples. Shows how to program against macOS's own security-centric frameworks (Endpoint Security, ESF) rather than relying only on third-party AV.

Skip this if

Analysts who don't see macOS in their pipeline. The platform specifics (Mach-O, code signing, TCC, XPC, launch agents) are non-transferable to other operating systems.

Readers who haven't worked through Volume 1's foundations first (Mach-O, code signing, persistence taxonomy); this book assumes that vocabulary and builds detection logic on top of it rather than re-teaching it.

Key takeaways

Mach-O analysis differs from PE analysis in non-trivial ways; the chapters on entitlements, code signing, and notarization are the practical foundation.
macOS persistence has its own taxonomy (LaunchAgents, LaunchDaemons, login items, period plists, dylib hijacks); learning it is half the analyst's job.
Apple's own tooling (Console.app, sample, fs_usage, Endpoint Security framework) is the right starting toolkit for triage; Wardle's framing is the cleanest in print.

Detection, not just analysis, is the book's whole focus — moving from "what is this sample doing" to "how do I catch the next one like it."
Builds heuristics directly on top of macOS's own security frameworks (Endpoint Security) instead of treating the OS as a black box.
Every technique is grounded in real malware families Wardle has tracked through Objective-See, not synthetic examples.

How they compare

The Art of Mac Malware, Volume 1 and The Art of Mac Malware, Volume 2 are both rated 4/5 in our catalog. Pick by topic preference and reading style rather than by rating.

Both books target advanced-level readers, so the choice is about topic, not difficulty.

The Art of Mac Malware, Volume 1 and The Art of Mac Malware, Volume 2 both cover Malware, macOS, so reading them in sequence reinforces the same material from different angles.

Keep reading

The Art of Mac Malware, Volume 1

→ Alternatives to The Art of Mac Malware, Volume 1 → What to read after The Art of Mac Malware, Volume 1