We discuss a bug in XProtect behavior events abused in the wild in current XCSSET malware campaign, then we explain why XProtect behavioral telemetry is fundamentally flawed.