Macos malware used runonly to detection