How to check your Mac for malware

MacUpdated

Your Mac already checks for known malware itself, using XProtect, Apple's built-in antivirus. Apple doesn't describe a button to start a scan yourself, so a hands-on check means two things: making sure that protection is up to date, then looking through what's installed and what it's allowed to do.

Quick answer

XProtect checks apps when they're first opened, when they've been changed and when its signatures update. To check by hand, turn on automatic security updates, review Login Items & Extensions, look through Privacy & Security for apps with access you didn't expect, glance at Activity Monitor and remove apps you don't recognise.

Is there a virus scan button on a Mac?

Not one that Apple describes. XProtect checks automatically, and Apple says macOS looks for new XProtect signatures once a day by default. When it finds known malware, it blocks it, moves it to the Bin and alerts you in the Finder.

How do I make sure the built-in protection is up to date?

Turn on automatic security updates. Apple lists XProtect's files among the security-configuration updates your Mac installs in the background.

  1. Choose Apple menu > System Settings, click General in the sidebar, then click Software Update.
  2. Click the Info button next to Automatic Updates.
  3. Turn on "Install Security Responses and system files". Apple's background updates page names it "Install system data files and security updates" for macOS Tahoe 26 or later.
  4. On macOS Tahoe 26 or later, also go to System Settings > Privacy & Security > Background Security Improvements and turn on Automatically Install.

Apple notes that a laptop has to be plugged in to download updates automatically. The NCSC's advice is to apply updates as soon as they're available.

What opens when I log in?

Apps can be set to open every time you log in, or to keep working in the background when they aren't open.

  1. Choose Apple menu > System Settings, click General in the sidebar, then click Login Items & Extensions. You may need to scroll down.
  2. Look through Open at Login. To remove something, select it and click the Remove button below the list.
  3. Look through App Background Activity. Apple describes these as apps that can perform tasks when the app isn't open.
  4. Under Extensions, click the Info button next to Added extensions to see what third-party developers have added, and turn off anything you don't want.

Search the name of anything unfamiliar before you remove it.

Which apps have access they shouldn't?

Privacy & Security lists the apps that have requested access to things like your camera, microphone, screen and keyboard.

  1. Choose Apple menu > System Settings, then click Privacy & Security in the sidebar.
  2. Click Input Monitoring, then Screen & System Audio Recording, then Accessibility. Turn off any app you don't recognise or no longer use.
  3. Check Camera, Microphone and Full Disk Access the same way.

For Accessibility, Apple's advice is to grant access only to apps you know and trust.

What can Activity Monitor tell me?

Activity Monitor shows the processes running on your Mac.

  1. Open Activity Monitor and click CPU.
  2. Click a column heading to sort the list, and click the arrow in that heading to reverse the order.
  3. Choose View > Applications in last 12 hours to see which apps have run recently, or View > System Processes to see the ones owned by macOS.
  4. To find something, type its name in the search field.

The FTC lists one sign worth knowing here: operating system tools like Activity Monitor being disabled can be a sign of malware.

How do I remove an app I don't recognise?

Apple's steps for an app you didn't install or no longer want:

  1. Quit the app if it's open.
  2. Find it in the Finder. Most apps are in the Applications folder, which you can open from the Go menu.
  3. If it isn't an Apple app, check whether it came with an "Uninstall" or "Uninstaller" app, or a remove option in its own menus or settings. If it did, use that.
  4. If not, drag the app to the Trash, or select it and choose File > Move to Trash. Enter an administrator name and password if asked.
  5. To delete it for good, choose Finder > Empty Trash.

Apple says you can't use the Finder to delete apps your Mac needs, such as Mail or Notes.

What do macOS malware warnings mean?

Apple describes several kinds of warning. The wording you see may not match exactly.

  • Malware found. Apple says your Mac tells you the app will damage your computer, or that it can't be opened, and moves it to the Bin. It may ask whether to share a copy with Apple anonymously.
  • Apple can't check the app. Apple's example reads "Apple cannot check 'Example App' for malicious software". Apple suggests contacting the developer, looking for an updated version in the App Store or finding an alternative.
  • Damaged or modified. Your Mac says the app can't be opened. Apple says it may be broken or corrupted, or it may have been tampered with.

Privacy & Security has an Open Anyway button for a blocked app. Apple's advice is to use it only if you're certain the app is from a trustworthy source and hasn't been tampered with.

When should I get help?

If something still seems wrong after all this, contact Apple Support through the Apple Support app or by phone. For a computer with malware, the FTC's advice is to stop logging in to online accounts, then change your passwords and turn on two-factor authentication. If a computer can't be cleaned, the NCSC says to wipe it, reinstall everything starting with the operating system, and restore from a backup made before the problem started. There's more on the warning signs in how to tell if your Mac is hacked.

Where Failshot fits

Your password is the first layer. Failshot is second layer device security for your Mac, for the moment someone sits down at your Mac and unlocks it. While it's on, it photographs whoever unlocks your Mac, then, with Pro, records a 5-second video, and its window tells them the unlock was photographed. With the Mac's built-in camera, the green light comes on.

With Pro, turn on alerts and Failshot emails you about an unlock you don't confirm as yours, a wrong Failshot PIN or answer, or its camera access being switched off while it's on. Switching it off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password.

Failshot for Mac is a free download for macOS 14 or later. Free to use. Pro adds video, email alerts and the encrypted vault. Try Failshot Pro free for 7 days. Your card is taken at sign-up and charged on day 8 unless you cancel.

More questions

What virus protection does a Mac have?

XProtect, which Apple describes as built-in antivirus technology for the signature-based detection and removal of malware, plus Gatekeeper and notarisation, which check apps from outside the App Store. The NCSC says keeping built-in antivirus switched on makes you safer straight away.

What's the best virus protection for a Mac?

For most people, the protection already in macOS, kept up to date. The NCSC warns that separate antivirus products won't always work alongside the built-in antivirus and could even stop it working. If you do add one, the NCSC suggests running a full scan when you first switch it on.

How do I scan my Mac for malware?

macOS scans apps automatically when they're first opened, when they change and when XProtect's signatures update. Apple doesn't describe a manual scan. Keep automatic security updates on, then check by hand using the steps above.

Will a malware warning delete the app for me?

For known malware, Apple says your Mac tells you the app can't be opened and moves it to the Bin. When Apple can't check an app, its example alert offers Move to Bin or Done, so the choice is yours.

Sources