Any system can be the victim of malware. For example, the technological difference between e.g. your friendly desktop search indexer and a malware syphoning of your private data is negligible.
That said, there has been no (well-known) malware so far for OS X that:
- Did not require active user involvement (like starting the program) and
- worked without exploiting a vulnerability in essentially 3rd party code (e.g. Flashback used Java, which is no longer installed by default anyway).
Some malware even requires users to enter their Administrator password during the installation.
Anti-virus software uses two basic mechanisms to detect malware:
- Known malware is identified through a specific pattern provided in the database by the anti-virus vendor. This is only capable of identifying widespread, known malware and requires you to keep your AV product and subscription updated.
- Dynamic (behavioral) and static (structural) characteristics of programs. This leads to false positives with software with legitimate use cases (like remote desktop/remote control software), and false negatives if there's no behavior legitimate software doesn't use — malware can still transfer your personal data to some remote server, and look as harmless as Dropbox or some other cloud/local syncing service.
So, while malware for OS X exists, it's far from the "receive a packet over the network and you're infected" quality that plagued early Windows XP. It's mostly trojans, exploiting social behavior patterns and other user vulnerabilities, instead of the OS. And for those, it really depends on how tech-savvy your users are.
OS X Mountain Lion, released earlier this week, includes Gatekeeper, a security feature that should keep most of these malware exploiting users' gullibility out, by only allowing execution of downloaded programs that are signed by developers registered with Apple.
If you don't give your users administrative access and the power to run arbitrary software, instead restricting them e.g. to the App Store, you should be as good as technically possible. Remember, an AV product is no panacea.
Note that this is no excuse to skip doing backups, run software downloaded from file sharing networks or file hosters with unknown origin, and other similar sense precautions.
