How to check for malware on Mac: what Apple does and what to look for

What macOS does without being asked

Apple’s Platform Security guide describes three layers. The first is to prevent launch or execution of malware, through the App Store or through Gatekeeper combined with Notarization. The second is to block malware from running, with Gatekeeper, Notarization and XProtect. The third is to remediate malware that has already executed, which is XProtect’s job. Notarization is a malware scanning service: developers who distribute apps outside the App Store submit them, Apple scans for known malware and, if none is found, issues a ticket; Apple can also issue a revocation ticket for an app known to be malicious even if it was notarized earlier, and macOS regularly checks for new ones so that Gatekeeper can block them.

XProtect is what the guide calls the built-in antivirus technology for signature-based detection and removal of malware, using YARA signatures that Apple updates regularly and independently of system updates. It checks for known malicious content when an app is first launched, when an app has been changed in the file system, and when the signatures are updated. When it detects known malware, it blocks it, moves it to the Trash and alerts you in the Finder; you might be asked to share a copy of the malware with Apple, and only the malware itself is uploaded. The guide says XProtect removes malware upon receiving updated information and continues to periodically check for infections, and that by default macOS checks for XProtect updates daily.

The alerts, and the one override

Apple’s page on safely opening apps, published on 27 May 2026, says the safest place to get apps is the App Store, and that for software from elsewhere macOS checks the developer’s signature and, by default in macOS Catalina and later, requires notarization. It lists the alerts you might see. If macOS detects that software has malicious content or that its authorization has been revoked, your Mac says the app will damage your computer. If it detects modified or damaged software, it says the app can’t be opened. If it detects known malware, it says the app can’t be opened and moves it to the Trash.

For an app that hasn’t been notarized or is from an unidentified developer, Apple says that running it might expose your computer and personal information to malware, and that if you are certain the app comes from a trustworthy source and hasn’t been tampered with, you can open System Settings, click Privacy & Security, scroll down and click the Open Anyway button, then confirm in the prompt that reappears. For the message that Apple could not verify an app is free of malware, see what that message means.

The signs vendors list, and the manual checks

Kaspersky lists a browser with a new homepage or extensions you haven’t added, which could mean it has been hijacked; many more ads or pop-ups than usual, which could be adware; and security alerts without scanning your Mac, which could be scareware. Intego, in an article dated 25 August 2026, lists software you don’t remember installing, such as browser add-ons or unfamiliar icons in Applications, and changes in performance or background activity, such as a slower or hot Mac or fan noise during light tasks. Trend Micro, in a page updated on 23 July 2025, describes ads clogging the browser, a changed homepage and extensions you don’t remember.

The manual checks are simple. Intego says to make sure the Mac is up to date, look through the Applications folder and the browser’s extension list for anything you don’t recognise, and check login items: on macOS Ventura and later in System Settings, then General, then Login Items; on Monterey and earlier in System Preferences, then Users & Groups, then Login Items. Kaspersky adds using Activity Monitor to identify potential malware, removing unknown browser extensions, and unticking Open “safe” files after downloading in Safari’s General settings, since some drive-by downloads may launch if it stays on. Penligent, a blog dated 27 January 2026 that promotes an AI penetration-testing tool, goes further: it suggests disconnecting from the network if you suspect active compromise, reviewing login items, sorting running processes by CPU and memory, checking whether a suspicious program is signed and notarized, and looking at the LaunchAgents and LaunchDaemons folders. We have not tried its Terminal commands.

Scanners, and what to do if one finds something

Intego says Apple’s Gatekeeper and XProtect work behind the scenes but don’t give you a way to run a manual check or see a status report, so a dedicated antivirus program is how you get a scan on demand; Intego sells such a program. Malwarebytes, whose page is a product page, says to download its free scanner, open the installer and click Scan, and that scanning finds threats already on the device while real-time protection is part of Premium. Kaspersky says that if you already have an antivirus program active, you should use a different scanner for the check, because your current software may not detect the malware, and it sells its own program too.

Intego’s advice if a scan finds something is to quarantine or remove the threat, restart and run a second scan if prompted, update the Mac and apps, check your key accounts for unfamiliar sign-ins and change passwords if needed, and restore from a clean backup made before the malware appeared if the infection caused deeper issues. For the steps to remove malware from a computer see removing malware from a computer, and for the signs on any computer how to tell if your computer has a virus.

Where the vendors and Apple differ

Trend Micro calls XProtect a “Mac Firewall” that makes it hard for malware to penetrate; Apple describes it as built-in antivirus technology for signature-based detection and removal. Intego says the built-in defenses give no manual check or status report, while Apple says XProtect continues to periodically check for infections and checks for updates daily by default; both can be true, since Apple describes no scan button. Penligent says the built-in layers are not designed to answer whether your Mac is already compromised; Apple’s description is of checks at launch, at change and at update. None of the vendor pages we read mentions the daily update check. Kaspersky, Intego and Malwarebytes sell security products, which is a reason to compare their claims with Apple’s.