New domains and new behavioral indicators, but malware authors stick to tried and tested architecture despite Apple’s updates.