Are you checking that the Mach-O binary is encrypted? I'm not aware of that being worked around by any of the automated tools (and it an approach that is widely discussed).