How to Check for Malware on Mac

Malware is a growing problem for Mac users, with close to 1 billion infections detected as of February 2024. As more people buy Macs, cybercriminals take an increased interest in targeting them with malicious software. Being careful and using antivirus software can help you avoid malware infections most of the time. But viruses, worms, ransomware, and other digital threats can sometimes get through anyway. If that happens, you need to know it’s there so that you can protect your Mac from malware.


As it's important to check for malware on Mac regularly, we'll explain to you how to do it effectively.


Before we start


If you suspect your Mac has a malware infection, every second counts. For that reason, we recommend running MacKeeper’s Antivirus tool.


Here’s how to run an on-demand scan:

  1. Open MacKeeper, and select Antivirus from the sidebar.
  2. Click Start Scan to run a full scan.
  3. When the scan finishes, review the results.
  4. Highlight what you want to remove, then click Move to Quarantine.

Using MacKeeper’s malware detector and remover is really that simple. Plus, it’s packed with other tools to keep your machine in top condition. Try MacKeeper today, and discover a safer, cleaner Mac.

How to know if your Mac has a virus

Can Macs get viruses? Yes, and it doesn’t matter if you have a MacBook Air, Mac mini, or an iMac. It’s also vital to detect malware as soon as possible. The sooner you know you have an infection, the sooner you can remove it, protecting your computer and data.


There are a few ways to detect viruses on Mac:

  • Look out for warning signs of an attack.
  • Check system folders for suspicious files.
  • Locate apps that you didn’t install.
  • Run an antivirus scanner app.

Signs of malware on Mac

Be aware of the fact that while some malware infections are obvious, others aren’t. Many attackers go to great lengths to conceal their malicious software so that you’re less likely to spot it and remove it, but there are some clear signs of malware that you can look out for:

  • Extremely slow performance: Many malware infections eat up a lot of processing power and memory, which makes your Mac feel sluggish and more unstable.
  • A browser homepage change: Some malware infections hijack your browser and then set a malicious website as your homepage, or redirect you to different sites.
  • Pop-ups and other intrusive ads: Displaying ads can be a profitable endeavor, so some adware infections place these wherever they can on your system.
  • Freeze-up and restarts: Malware infections can often make your Mac unstable, which can lead to frequent freezes and restarts.
  • Bogus security alerts: If you see a security alert that doesn’t look genuine, it could be malware that’s trying to steal payment information or direct you to other malicious downloads.
  • Your friends receive spam from you: Do you have a friend who says they received spam or strange messages from one of your accounts? This is a common sign that malware has infected your Mac and gained access to your messages and emails.

And if your Mac gets infected with ransomware, it’ll be pretty obvious. You’ll get a demand to pay a ransom, and you’ll find your files or drives have been encrypted and can’t be opened.

The difference between malware and a virus

Malware is short for malicious software, an umbrella term for all kinds of nasty programs that can be harmful to your computer and your data. Technically, viruses are a type of malware, but there’s a difference between these and other infections.


The key aspect of a virus is that it’s usually a small program that infects other files and applications on your Mac, and then spreads throughout your system. This is unlike other malware infections that are built as standalone pieces of software, which try to look legitimate or disguise themselves as something else.

List of Mac viruses

There are many, many viruses built for Mac, and every year, thousands of new infections surface. As the macOS operating system has become more popular, this problem has only gotten worse. Some of the most recent and most common infections include XMRig, MacStealer, and RustBucket. For a complete list and details on how each one works, see our guide to Mac viruses.

How to scan for viruses on Mac

There are a few different ways to scan for viruses on Mac, some of which are built right into macOS:

How to identify malware with Activity Monitor

If you suspect your Mac has been infected with a virus, one of the best places to identify malware is in Activity Monitor. Here, you’ll be able to see background processes and apps that are running—including viruses, adware, and other nasties.


How to check Activity Monitor for Mac viruses:

  1. Open Activity Monitor from Applications > Utilities. Go to the CPU tab if you’re not already in it.
  2. Click the % CPU column to sort all processes by CPU usage, and look for anything in the list that’s eating up a lot of CPU power.
  3. If you see a suspicious process, do a Google search on it. You should find information that confirms whether it’s malware or not.
Open the macOS Activity Monitor app, and click the CPU tab. Often malware will work in the background, using up system resources, which you can spot here.
Step 1. Go to the CPU tab in Activity Monitor
Click on the %CPU tab to sort processes by how much processing power they're using. This makes it easier to find anything out of place.
Step 2. Click on %CPU to sort processes
If you do see anything suspicious, then take note of its name and search for it in Google. Often, this will confirm whether it's malware or not.
Step 3. Search for suspicious processes

Run a Mac virus scan using built-in tools

Every Mac comes with antivirus detection built in. macOS includes a technology called XProtect, which scans your Mac for malware using a database of virus signatures maintained by Apple. This is enabled by default, so you don’t need to do anything to use it. If you download malware and try to run it, XProtect can detect it and stop it from running.


Here’s how to check XProtect is getting updates:

  1. In System Settings, select General > Software Update.
  2. Click the i icon next to Automatic Updates.
  3. Make sure Install Security Responses and system files is activated.
Open your Mac's System Settings, click 'General', followed by 'Software Update'. Here you'll be able to check security updates are on.
Step 1. Go to General > Software Update in System Settings
At the top of the window, you should see 'Automatic updates'. Click the 'i' icon to see more information about updates.
Step 2. Click the i button next to Automatic updates
Now, check that your Mac is set to automatically download and install updates. This will make sure that XProtect is working properly and protecting your Mac
Step 3. Make sure security updates are on

Note from our experts: XProtect, although better than nothing, is limited in a few key ways. Apple isn’t a security company, for a start, so XProtect doesn’t detect as many viruses as a dedicated security app, and you don’t get full control over the cleanup. XProtect is a passive solution–you can’t run a scan to check your Mac for malware, so it’s not the best way to clean viruses from your Mac.  

Check for unwanted applications

The Applications folder might not seem like the best place to check for Mac viruses. After all, most malware wants to remain hidden within unwanted apps, and, that’s why, is difficult to access. Still, it’s worth starting to detect a trojan virus on Mac from this folder as it can contain seemingly legitimate apps, which are actually loaded with viruses.


How to check for suspicious apps:

  1. Go to the Applications folder.
  2. Look for any apps you don’t recognize or don’t remember installing. Check Google to see if they’re legitimate or not. If they’re not, or if you’re suspicious, delete them and empty your trash.
Check your Applications folder for apps that seem suspicious or that you don't remember installing. They could harbour viruses.
Step 1. Open the Applications folder
If you spot anything that shouldn't be in your Applications folder, Google it, then send to your trash and empty your trash to delete permanently.
Step 2. Move suspicious applications to Trash

Alternatively, it’s even easier to remove unwanted apps with MacKeeper’s Smart Uninstaller:

  1. In MacKeeper, select Smart Uninstaller in the sidebar.
  2. Click the Applications option.
  3. Select the apps you want to uninstall, then click Remove Selected.
MacKeeper on Mac shows the Smart Uninstaller tool. Click Applications to see a list of all apps you can remove from your Mac.
Step 1. In MacKeeper, select Smart Uninstaller > Applications
MacKeeper on Mac shows the Smart Uninstaller tool. After selecting the apps you want to uninstall, click the Remove Selected button.
Step 2. Select apps to uninstall, then click Remove Selected

Check the Downloads folder

Whenever you search for malware on Mac, you should check your Downloads folder. If you’ve been tricked into downloading something malicious, there’s a good chance you’ll see it there.


Simply follow these steps to check your Mac’s downloads for malware:

  1. Open a new Finder window, and select Downloads from the sidebar.
  2. Look through your downloads for anything that you don’t recognize or don’t recall downloading. Right-click it, and select Move to Trash / Move to Bin.
  3. Right-click your trash/bin, and select Empty Trash / Empty Bin.
You may find suspicious files in your Downloads folder. Deleting them could be just what you need to protect your Mac from potential infections.
Step 1. Open your Download folder
Look through your Mac's Downloads folder for anything that seems suspicious, including files and installers that you don't remember downloading.
Step 2. Send anything suspicious to your trash

Check suspicious login items

Malware will often load automatically when you start your Mac, and you might check your macOS login items list. Bear in mind, though, many login items like Launch Daemons, and Launchagents won’t actually appear in this list, so you may need to go further to find them and protect your Mac from malware.


Here’s how to check suspicious login items this way:

  1. In System Settings, select General > Login Items.
  2. Look through the list and select anything you think is suspicious.
  3. Click the minus button to remove the login item.
In System Settings, click 'General', then click 'Items'. From there, you'll be able to see what's running on your Mac automatically at boot time.
Step 1. Open General > Login Items from System Preferences
Look through the list of login items. if there's anything that you don't recognize in the list, it could be some kind of Mac malware.
Step 2. Select apps you think are suspicious
To remove a login item, simply click on it to select it, then click the 'minus' button to delete it from the list. It will no longer start at boot-up.
Step 3. Remove the login item

Additionally, you can also manage login items using the MacKeeper app like so:

  1. In MacKeeper, select Login Items in the sidebar.
  2. Select the items you don’t want to run at startup, then click Remove Select Items.
MacKeeper on Mac shows the Login Items tool. Select the apps you don't want to run at startup, then click Remove Selected Items.
Step 1. In Login Items, select apps you don’t want to run at startup
MacKeeper on Mac shows the Login Items tool. After selecting the apps you don't want to run at startup, click Remove Selected Items.
Step 2. Click Remove Selected Items

Check browser extensions

Malicious browser extensions that monitor your online activities and steal your data have become increasingly common. Check your browser for suspicious extensions and delete any you don’t recognize or no longer need to prevent them from causing any harm.

Clear your cache

If your web browser has been infected by Mac malware, you need to ensure you clear its cache once the malware has been dealt with. The cache is where your browser stores files that it may need to use again in the future, and these can often become infected as well.


To clear your cache in Safari, follow these steps:

  1. Open Safari, then click Safari > Settings in your Mac’s menu bar.
  2. Click the Privacy tab, then select Manage Website Data.
  3. Click the Remove All button, then select Remove Now to confirm.
Safari Settings on Mac shows the Privacy section. Click Manage Website Data to clear all browser cache files.
Step 1. In Safari Settings, click Privacy > Manage Website Data
Safari on Mac shows all website data. Click the Remove All button, then click Remove Now to remove all cache files.
Step 2. Click Remove All, then select Remove Now to confirm

Here’s how to clear your cache in Google Chrome:

  1. Open Google Chrome.
  2. Click History > Show Full History in your Mac’s menu bar.
  3. Select Clear browsing data.
  4. Ensure Cached images and files are selected, then click the Clear data button.
Google Chrome on Mac shows the History menu. Click Show Full History to clear your Google Chrome cache files.
Step 1. In Chrome, select History > Show Full History
Google Chrome on Mac shows the History section. Click Clear browsing data to delete all Chrome cache files.
Step 2. Click Clear browsing data
Google Chrome on Mac shows the Clear browsing data menu. Select Cached images and files, then click the Clear data button.
Step 3. Select cached files, then click Clear data

Hint from our team: 


If you prefer using browsers other than Chrome or Safari, there’s no need to panic. Instead, check our full guide on clearing cache on Mac and find the required instructions.

Check if your email has been compromised

Some malware infections gain access to your email to steal personal data, which attackers can then use to clone your identity and take out phone contracts, credit cards, and other things in your name. Therefore, it’s important to check if your email account is safe.


See if your email has been compromised with MacKeeper’s ID Theft Guard like so:

  1. In MacKeeper, select ID Theft Guard in the sidebar.
  2. Check your personal data leaks, then click Review.
  3. Click Send Code to receive a verification code for safety.
  4. Find the code in your email inbox, then paste it into MacKeeper and click Enter.
  5. Check all accounts that have been compromised and follow the steps to fix them.
MacKeeper on Mac shows the ID Theft Guard. To check if your email has been compromised, click the Send Code button to start
Step 1. Select ID Theft Guard then click Send Code.
Safari on Mac shows an email account with the MacKeeper ID Theft Guard verification code. Copy the code so it can be pasted into MacKeeper.
Step 2. Copy the code sent to your email
MacKeeper on Mac shows the ID Theft Guard. Paste the verification code sent to your email into the box, then click Enter.
Step 3. Paste the code into MacKeeper > click Enter
MacKeeper on Mac shows the ID Theft Guard. Check all compromised accounts and follow the steps to fix them.
Step 4. Check each account and follow steps to fix them

How to scan a Mac for viruses with MacKeeper

Ultimately, trying to find malware on your Mac manually is a losing game. Well-designed viruses don’t make themselves easy to find or remove. Built-in features like XProtect do help, but do Macs need antivirus too? Without a doubt. When it comes down to it, the best way to scan a Mac for viruses is to use a tool like MacKeeper, which is capable of protecting and cleaning your device.


There are two main types of protection you need to use—antivirus scans and real-time protection. Scans can be carried out on demand, searching your entire system or chosen folders for malware, so you can clear a virus from your Mac when you need to. Real-time protection is always on, and if you download or try to run a virus, it kicks in and lets you know.


Here’s how to run a virus scan in MacKeeper:

  1. Open MacKeeper, and select Antivirus from the sidebar.
  2. If you want to scan certain folders only, click Custom Scan. Otherwise, click Start Scan.
  3. When the scan is finished, select any detected malware, and you can either delete it from your Mac or move it to Quarantine.
If you suspect you have malware on your Mac, open MacKeeper, then select the Antivirus tool from its side menu.
Step 1. Go to Antivirus tab in MacKeeper
To scan a particular file or folder on your Mac, click the Custom Scan option in MacKeeper, in the bottom right.
Step 2. Click on Custom Scan
If you don't want a custom scan, just click Start Scan. This will scan your entire Mac, looking for malware infections.
Step 3. Click Start Scan
If MacKeeper finds anything suspicious on your Mac, it will come up in the scan results. Just click 'Move to quarantine' to remove it.
Step 4. Manage detected malware (delete or move to quarantine)

How to avoid malware on your Mac

Just as important as knowing how to remove Mac malware is knowing how to avoid it so that you don’t pick up more infections in the future. Fortunately, it’s not difficult to maintain a healthy Mac with a few simple steps:

  • Avoid suspicious software: macOS will prevent you from opening potentially unsafe software from unregistered developers. Keep these protections enabled to prevent malware from being installed, and only download software from trusted sources.
  • Be wary of fake files: Viruses are often hidden inside files that are disguised as innocent downloads, such as PDF documents, Word files, and app packages. Don’t trust files if you can’t be sure of where they came from, and be extra cautious before opening files that have been sent to you through emails. Don’t open files that suddenly appear without warning.
  • Look out for fake updates and tools: Some viruses disguise themselves as software updates, system tools, or trusted applications. Only download these things from trusted sources, such as the App Store or an official developer webpage.
  • Don’t trust unsolicited support: If you receive a call or message offering Mac support that you didn’t ask for, ignore it. Genuine support companies don’t cold call customers to provide help for no reason, so it’s likely a scammer trying to convince you to download a virus.
  • Follow good cyber practices: Take the usual precautions to protect your Mac and your data whenever you use your machine. Avoid untrusted websites, use antivirus software, use strong passwords that you don’t share with others, and be wary of sharing personal data.

What to do if your Mac has a virus

If you’ve carried out the appropriate checks and discovered that your Mac has a virus, you’ll need to deal with it as quickly as possible. In addition to following the above steps, there are other precautions you can take to minimize the damage the virus can do, including:

  • Stay offline: Disable the Wi-Fi on your Mac from the Control Panel, or disconnect the Ethernet cable if you use a wired connection. If possible, turn off your router temporarily. This will stop any viruses from communicating with the attackers’ servers and prevent any more of your data from being transmitted to them.
  • Avoid logging into any accounts: Avoid logging into any of your accounts, or entering any passwords until you can be sure the virus is removed. If the virus is using a keylogger to record all of your keyboard inputs, this will ensure that it cannot steal any. Also, avoid opening any password managers you use to prevent the virus from taking screenshots of them.
  • Change your Mac’s login password: In System Settings > Users & Groups, change all the login passwords for your Mac to ensure the virus cannot access your machine remotely using details it has already stolen.
  • Change your iCloud password: If the virus has stolen your iCloud password, it’ll be able to access your saved passwords, photos and videos, messages, and all other data that is uploaded to the cloud. In System Settings > Apple ID > Sign-In & Security, change your iCloud password to prevent others from logging in.
  • Cancel debit and credit cards: Call your bank and credit card providers to cancel all the cards you have saved on your Mac. This will prevent attackers from using any payment details they may have stolen.

How to remove malware from Mac

If you ever pick up an infection, then you need to know how to remove malware from your Mac. In extreme cases, that may involve resetting your Mac or restoring from a backup, but often you can get rid of viruses on your Mac by following our pieces of advice:

  • Check for suspicious background processes with Activity Monitor.
  • Make sure XProtect is enabled.
  • Check for unwanted applications.
  • Look in your Downloads folder for suspicious files.
  • See if you’re running any suspicious login items.
  • Run a virus scan with MacKeeper.

Doing so, you’ll keep your Mac clear of malware and protect your data. Using MacKeeper’s Antivirus is particularly important because it includes real-time protection. This way, you can stop viruses from ever taking hold rather than acting only when the horse has already bolted. For more information on keeping your Mac safe, check out our Mac security guide.



How do I run a malware scanner on my Mac?

To find hidden malware on your Mac, use the Antivirus utility built into MacKeeper. It trawls through your entire system to weed out malicious applications and then removes them. Also, our tool uses a real-time monitoring feature to ensure that you’re alerted to new threats as soon as they appear.

Does Mac have a built-in malware scan?

Yes, macOS has a built-in tool called XProtect that scans your system for viruses and malware. However, it doesn’t have the ability to perform on-demand scans or scan specific files and folders like a dedicated antivirus tool.

How can I clean my Mac from malware?

You can manually remove malware from your Mac by uninstalling unrecognized apps and deleting suspicious processes. However, it can be difficult to locate hidden malware programs, which is why dedicated tools like MacKeeper’s Antivirus are essential to many users.

Is it possible for a Mac to have malware?

Yes, there are tens of thousands of malware infections built for Mac, and that number only increases as the operating system becomes more popular. Although macOS is regarded as being less susceptible to malware than Windows, it’s certainly not immune, as some Mac users believe.

Use your Mac to the fullest! Sign up and get:
Effective tips on how to fix Mac issues
Reliable advice on how to stay safe online
Mac-world news and updates

Thank you!

You’ll love exploring your Mac with us.

Oops, something went wrong.

Try again or reload a page.

Here’s another sign you need to upgrade your macOS ASAP:

30% off your MacKeeper subscription

Сopy the code now and use it in the MacKeeper checkout after the upgrade.

Copy Code

Please be aware that this code cannot be combined with any other discounts, offers, or promotions.



Regularly scan your Mac for malware and get 24/7 real-time protection

Start Now

MacKeeper - your all-in-one solution for more space and maximum security.

Try Now

Read more

How to Remove VBS:Malware-Gen from Mac
How to Remove VBS:Malware-Gen from Mac
How to Remove Search Baron Virus from Mac
How to Remove Search Baron Virus from Mac

Run Application


Click Continue


Click Install


Your macOS version is lower than OS 10.11. We’d like to offer you MacKeeper 4 to solve the cleaning, privacy, and security issues of your macOS.