How to Check for Malware on Your Mac

A slow Mac, unexpected pop-up, or unfamiliar app gives you a reason to investigate. Start with the symptom you noticed, then use the relevant checks below to narrow it down.

Signs Your Mac May Have Malware

Start with the symptom you can observe:

• Unexpected pop-ups may be website notifications or advertising. Do not follow links in browser alerts claiming your Mac is infected.
• 🐢 Slower Performance: Your Mac suddenly becomes sluggish without any clear reason.
• 📦 Unfamiliar Apps: Unknown apps show up in your Applications folder or on your desktop.
• 🌀 Erratic Behavior: Applications frequently crash, freeze, or behave unpredictably.
• Sustained high CPU use can help you identify a demanding app or background task to investigate.
• 🌐 Browser Hijacking: Your browser redirects to unknown websites or its homepage changes without permission.
• 🔍 Unwanted Toolbars: Strange browser toolbars appear that you didn’t install.
• If contacts report messages you did not send, secure the email account from a trusted device and review its sign-in activity; this alone does not establish that the Mac is infected.

How to Check for Malware on Your Mac

Use the following six checks to investigate the app, browser, permission, or download involved in your concern.

1. Use Activity Monitor to Investigate Resource Use

Activity Monitor shows which processes are running and how much of your Mac’s resources they use. It doesn’t scan files or tell you whether a process is malware.

Use it when an app is slow, the fan is loud, or one process keeps using resources after the related task ends.

1. Press Command ⌘ + Space, search for Activity Monitor, then open it. You can also find it in Applications > Utilities.
2. Choose CPU, then click the % CPU column to sort by processor use. Click again if the highest values aren’t at the top.
3. Look for sustained activity that matches the symptom you noticed. Short spikes can be normal during updates, video calls, indexing, and exports.
4. If you need more context, select the process and use the information button. Verify the related app and its developer before changing anything.

12

Don’t force-quit an unfamiliar process just because it appears near the top. Closing a process doesn’t uninstall its app or remove malware, and stopping a system process can interrupt your work.

If a trusted security alert names a file or app, follow the alert and the developer’s removal instructions instead.

For a performance problem without a security alert, follow our slow Mac troubleshooting steps. Apple’s Activity Monitor guide explains the CPU and memory views.

2. Review Full Disk Access Permissions

Full Disk Access allows an app to read a broad range of files, including data from other apps and Time Machine backups. Reviewing this list is a permission check, not a malware scan.

Familiar backup and security apps may legitimately need access.

1. Click the Apple logo and select System Settings.

2. In System Settings, click the Privacy & Security tab and in the Privacy section, click Full Disk Access.

3. Compare the list with apps you or your organization intentionally installed. Check an unfamiliar entry’s developer and purpose before changing access.

4. If you confirm an app should not have access, turn off its switch. This limits future access; it does not uninstall the app or reverse access it already had.

3. Review Login Items and Background Activity

Login items can reopen apps when you sign in, and background items let apps keep working after you close a window. Both can be legitimate.

Investigate an item when it belongs to an unwanted app or matches the behavior you noticed.

1. Open System Settings > General > Login Items & Extensions. Some earlier releases call this pane Login Items.
2. Check the app or developer listed for the item. If you recognize it and don’t want it to open when you sign in, remove it from Open at Login.
3. Review background permissions separately. Disabling one can stop an app’s updates or other expected features, so change only items you understand.
4. If the same unwanted app returns, follow the app developer’s removal instructions or get help. Removing a login item alone doesn’t remove malware.

Use our login-item guide for the settings in different macOS releases. Keep the app’s own updater enabled when you still use that app and trust its source.

4. Check Apps You Do Not Recognize

Check where the app came from, which developer made it, and whether you or your organization installed it.

If it’s a work Mac, check with your administrator before removing managed software.

1. Open Finder > Applications and locate the app you’re investigating. Don’t open a suspicious app just to identify it.
2. Select it and choose File > Get Info for its version and other available details. Compare those details with the developer’s official website or a trusted security alert.
3. If you’ve confirmed it’s unwanted, check the developer’s uninstall instructions first. Use its supplied uninstaller when available. Otherwise, quit it and move the app to the Trash.
4. Review what’s in the Trash before emptying it. Emptying it permanently removes those files. Keep documents and other files you still need, and don’t delete unfamiliar Library or system folders.

Our app-removal guide covers the usual uninstall options. If a trusted scanner identifies malware, follow its specific removal steps rather than assuming that deleting the app icon is enough.

5. Review Browser Extensions

Inspect an extension’s developer and permissions in the browser settings before deciding whether to disable or remove it.

1. Access Extensions or Add-ons:
   1. Safari: Go to Safari > Settings > Extensions.

2. Chrome: Click the three vertical dots (menu) > More tools > Extensions.

3. Firefox: Click Firefox > Settings > Extensions & Themes.

2. Review the list of installed extensions, looking for any you don’t recall adding or that seem out of place.
3. Click the extension to view more details, such as its permissions or the developer’s name. This can help you determine its legitimacy.
4. For any extension you wish to remove:
   1. Safari: Clear the checkbox to disable the extension. To remove it, select it and click Uninstall.

2. Chrome: Click the Remove button.

3. Firefox: Click the three dots next to the extension and select Remove.

5. After removing extensions, close and reopen your browser to ensure the changes take effect.

6. Check Downloads Before Opening or Deleting Files

A file in Downloads is not harmful just because its name is unfamiliar. Check its source and file type before opening it; delete it only if you are sure you do not need it.

1. Launch Finder and select Downloads from the left sidebar.

2. Check the source and file type of each download you plan to open or delete.
3. If you come across unfamiliar files, right-click them and select Get Info to see more details, like the date it was downloaded.

4. Select the files or folders you want to remove, then right-click and choose Move to Bin, or simply drag them to the Bin icon in the Dock.

5. To permanently delete the items and free up space, right-click the Bin icon in the Dock and select Empty Bin.

6. Consider moving important files to more appropriate locations on your Mac, such as the Documents folder, for better organization.

Check suspicious files with MacKeeper Antivirus

MacKeeper Antivirus can scan your Home folder or selected files and folders for malware. Use a targeted scan when you need to investigate a suspicious download or a security concern.

Download MacKeeper from its official source, check compatibility with your macOS version, and follow its setup prompts. Review the permissions requested before granting Full Disk Access, which allows scanning additional locations.

Open MacKeeper, select Antivirus in the sidebar, and click Start Scan for the default Home-folder scan. To inspect particular items, choose Custom Scan, add the files or folders, and start the scan. MacKeeper’s Antivirus instructions show the current controls.

Review any detections before taking the removal action shown in the app. Keep the alert and file details if you need help interpreting a result. A scan cannot guarantee that every threat has been found.

What to Do If You Find Malware on Your Mac

Keep the alert text, file name, and app name so you can describe the problem accurately.

If the warning came from a web page, confirm whether it was a browser message or a genuine macOS alert before installing anything.

If an account may be exposed, use a different trusted device for password changes and recovery.

If macOS or a trusted scanner identifies a threat, follow the alert’s instructions. Avoid manually deleting system files or changing passwords on a potentially compromised device before considering account and device recovery steps.

1. If you have a credible active compromise, disconnect from the network while you seek help. For an unconfirmed symptom, preserve the alert details and avoid opening the suspected app.
2. Use Safe Mode only if troubleshooting instructions call for it. Apple’s steps differ for Apple silicon and Intel Macs; follow its device-specific instructions.
3. Use an up-to-date scanner from a reputable developer if a scan is warranted. Review any detection before removal; no scanner can promise to identify every threat.
4. Do not manually delete a file unless a trusted alert or qualified professional has identified it and you have verified its location. Removing the wrong file can damage an app or macOS.
5. Update All Software: Ensure your macOS, browsers, and other software are up-to-date. Software updates often include patches for known security vulnerabilities.
6. If you have evidence that an account was accessed, change its password from a separate, trusted device and follow that service’s account-recovery guidance.
7. Reinstalling macOS is a major step and does not by itself guarantee that personal files or accounts are safe. Get device-specific guidance from Apple Support before erasing or reinstalling.

How to Stop Malware Getting on Your Mac

These steps reduce common risks, though no checklist can prevent every threat:

1. Keep any security app you use up to date, obtain it from its developer’s official source, and review the permissions it requests.
2. 🔄 Keep macOS Updated: Install macOS updates regularly to benefit from Apple’s latest security patches.
3. 🚫 Download Wisely: Only download apps from trusted sources like the Mac App Store or official websites.
4. 📧 Beware of Phishing Emails: Avoid clicking on suspicious links or opening attachments in unsolicited emails.
5. Review network access: The macOS firewall controls incoming connections. It doesn’t scan downloads or replace malware removal.
6. Protect accounts and downloads: Use unique passwords and two-factor authentication. A VPN doesn’t make a malicious download safe or reverse account theft.

Keep Your Mac Safe From Malware

macOS has built-in protections including Gatekeeper, notarization, and XProtect. Activity Monitor is a process viewer, and Time Machine is a backup tool; neither is a malware scanner.

Keep macOS and apps updated, download software from sources you trust, and take time to read unexpected security prompts before approving them.

• Macs can be affected by malware, and macOS includes built-in protections that help reduce the risk.
• For a suspicious file or a specific security concern, use the scan and detection-review steps above.

Frequently Asked Questions

Affiliate disclosure: MacBook Journal may earn a commission when you buy through links on this page, at no extra cost to you.