It is true, and worth saying plainly: ransomware written to run natively on macOS is uncommon. KeRanger, found in 2016, remains one of the very few documented examples of fully working Mac ransomware, and it required a compromised, legitimately signed installer to spread at all.
Why "my Macs are safe" is still the wrong conclusion
That rarity describes ransomware code written for macOS specifically — it says nothing about the risk to a small business that happens to use Macs. According to Cybermalveillance.gouv.fr’s 2024 activity report, ransomware remains the third most common reason French businesses of all sizes request help, and the second most common for local public bodies, even as the raw number of cases has fallen to its lowest point in four years.
Modern ransomware overwhelmingly targets shared infrastructure — file servers, cloud-storage folders, backup systems — not any one operating system. A Mac with access to a shared drive, a cloud folder, or a company VPN is a viable entry point and a viable victim of encryption, even if the ransomware itself never runs a single line of Mac-native code.
What actually reduces the risk
- Treat every device with access to shared files as part of the attack surface, regardless of operating system.
- Keep backups that ransomware on a connected Mac cannot also reach and encrypt — offline or versioned, not just another synced folder.
- Watch for a single device suddenly making unusual volumes of connections to storage services — often visible before the damage is.
How FireAI and HisnLabs fit in
A firewall will not decrypt a ransomed file, but it can be the thing that notices an employee’s Mac suddenly making hundreds of connections to cloud-storage folders it has never touched before — often the earliest visible sign that something is spreading.
FireAI is HisnLabs’ own product: an on-device AI firewall for Mac. It shows every connection your apps make, in plain language, and lets you decide what leaves your Mac — its AI runs locally, so your traffic is never sent to us or anyone else. HisnLabs’ security research team is the group that keeps that decision-making accurate: cataloguing which domains are ordinary telemetry versus a real product, tracking the country and network behind a connection, and training the on-device model (its Autopilot feature) on real traffic patterns, all without any of it leaving your Mac.
You can read the technical decisions behind it, or try FireAI for 17 days, at FireAI, by HisnLabs.