An ad hoc signed binary is a macOS executable that carries a temporary signature but no persistent developer identity. In practice, the file has been signed locally or in a minimal way so the operating system can record a signature state, yet it is not tied to a trusted Apple Developer ID or a long-term certificate chain.
This matters because the signature may help with basic integrity checks, but it is a weak trust signal for security teams. Ad hoc signing does not prove who built the file, whether it was reviewed, or whether it is safe to run. Attackers can use this appearance of validity to reduce suspicion, especially in malware samples or test tools that need to look less obviously unsigned. Defenders should treat ad hoc signed binaries as untrusted by default and combine signature status with sandboxing, reputation checks, static analysis, and behavior monitoring.