[j0hnml]

If I had to guess, I'd say they will probably roll out new XProtect signatures [1] soon, assuming they haven't done so already for these samples.

I also just learned that you can see when the last update was with the following command:

```

system_profiler SPInstallHistoryDataType | grep -A 5 "XProtectPlistConfigData"

```

And then any updates are added to `/Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.yara` (for macOS 11, at least).

[1] https://support.apple.com/guide/security/protecting-against-...