How is the /AppleInternal directory hidden from users on macOS? If you didn't know macOS has a well hidden directory called  "/AppleInternal" that is pretty secretive. It's not possible to ls or rm it and I've never seen it referenced before with anything other than fs_usage, where it was being listed frequently as /AppleInternal or /AppleInternal>>>>>>>>>>>>>> with usually between 5 and 20 >. 

Thought it was some reference to something other than a directory but the / before AppleInternal made me wonder and google has an article about how to enable it, which apparently added some hidden features to Xcode. 

I booted into recovery and used mkdir (you aren't allowed to do it outside of recovery mode) and there is now a folder with that name but its empty. fs_usage no longer makes any reference to /AppleInternal and ls shows the created date as when I used mkdir. Seems like a questionable use if it could just be done away with once discovered as well as be hidden so well and referenced so frequently prior to adding my own. 

Seems like a fairly good place to hide malware really. 

I found a single, vague reference to AppleInternal in all of the man pages. It's in ani (Apple Net Install) which says AppleInternal and AppleInternalAssistant are both dmg image types. 

So does anyone have any idea how it is able to hide so well or have any additional information on its true purpose?
It is not really a "hidden" directory or "secretive" in any way.

It is simply that some Apple employees have use a folder with this specific name when testing/using prototype or in-development software on iOS and macOS. The idea is to store testing tools and other files that are not meant to be in the software meant for customers.

The technical concept here is that the contents of that folder is combined with the "ordinary" file system (sort of like an overlay). So if you want to add something to /System/Library/ for testing, but don't want to do it in the "real" software - you could add it to /AppleInternal/System/Library/ instead - and get the same effect.

The folder does not exist unless it is actively created. Therefore the folder is not hidden - it is simply not there on an ordinary installation of macOS.

When you run Xcode, which is meant for developers, it will check if this folder exists - and then for example the iOS simulator will have a few extra options, that are primarily meant for Apple employees. This could be for example features that haven't been tested well enough to be exposed to customers.

The AppleInternal folder has been well-known by non-Apple employees for years - so it is not a new discovery.