A universal binary is a single macOS executable that contains code for more than one CPU architecture, usually Intel and Apple silicon. The system chooses the correct slice at launch, which lets one package run on mixed Mac fleets without separate downloads.
This format matters in cyber security because it can also help malware reach more targets with one file. Attackers may hide a payload in a universal Mach-O, then unpack it when the installer runs so the full code is not obvious during quick inspection. Defenders look for mismatched signing, unexpected architectures, unusual post-install behavior, and runtime extraction activity. In practice, universal binaries are not suspicious by themselves; the risk comes from how they are packaged and delivered.