If your Mac has been acting strangely – sluggish performance, unexpected pop-ups, browser redirects, or unfamiliar processes consuming CPU – you may be dealing with a malware infection. While macOS has a reputation for being more secure than Windows, it is not immune to threats. Knowing how to check for malware on Mac is an essential skill for anyone who takes their digital security seriously.
This guide walks through a systematic approach to detecting and removing malware on macOS, from built-in tools to specialized scanning utilities and terminal-based investigation techniques.
Recognizing the Signs of Mac Malware
Before diving into how to check for malware on Mac, it helps to understand what suspicious behavior looks like. Common indicators include:
- Noticeably slower system performance without an obvious cause
- Browser homepage or search engine changed without your consent
- Unexpected pop-up advertisements, even when no browser is open
- Applications crashing frequently or failing to launch
- Unusually high CPU or network activity when the system should be idle
- New browser extensions or toolbar items you did not install
- Ransom messages or screen lock warnings demanding payment
Any combination of these symptoms warrants a thorough investigation. The absence of obvious symptoms does not guarantee a clean system either – some malware operates silently, exfiltrating data or mining cryptocurrency in the background.
Using Activity Monitor to Identify Suspicious Processes
The first step when you suspect malware is to open Activity Monitor (Applications > Utilities > Activity Monitor). This built-in tool shows all running processes and their resource consumption.
Click the CPU tab and sort by CPU usage (descending). Look for processes consuming abnormally high CPU that you do not recognize. Common legitimate high-CPU processes include kernel_task, WindowServer, and mds_stores. Anything unfamiliar – especially processes with random-looking names or processes consuming 80-100% CPU persistently – deserves investigation.
Select a suspicious process and click the Info button (the “i” icon) to see its full path. Legitimate macOS processes typically reside in /System, /usr, or /Applications. A process running from /tmp, /var/folders, or a hidden directory in your home folder is a red flag.
The Network tab is equally valuable. Sort by Sent Bytes or Received Bytes to identify processes making unusual network connections. Malware that phones home to a command-and-control server will show persistent outbound network activity.
Checking Login Items and Launch Agents
Malware frequently establishes persistence by adding itself to Login Items or installing Launch Agents and Launch Daemons. These mechanisms ensure the malware restarts after a reboot.
To check Login Items, go to System Preferences > Users & Groups > Login Items. Review the list and remove anything you do not recognize. On macOS Ventura and later, this has moved to System Settings > General > Login Items.
Launch Agents and Daemons require a deeper look. Open Terminal and list the contents of these directories:
ls -la ~/Library/LaunchAgents/
ls -la /Library/LaunchAgents/
ls -la /Library/LaunchDaemons/
ls -la /System/Library/LaunchDaemons/Legitimate Launch Agents typically have identifiable developer names in their filenames (com.apple.*, com.google.*, etc.). Files with random strings, misspelled company names, or names that do not match any software you installed should be examined. Open the .plist file with a text editor to see what executable it launches and research that path.
macOS Built-in Protection: XProtect and MRT
Apple includes several built-in security mechanisms that work silently in the background. Understanding these helps you know what is already being checked when you want to check for malware on Mac.
XProtect is Apple’s signature-based malware scanner. It checks downloaded files against a database of known malware signatures. XProtect updates automatically through system updates, and its definitions are stored in /Library/Apple/System/Library/CoreServices/XProtect.bundle. While XProtect catches known threats, it cannot detect zero-day malware or threats that have not yet been added to its signature database.
MRT (Malware Removal Tool) runs periodically to scan for and remove known malware that may have already been installed. Like XProtect, it relies on known signatures. On newer macOS versions, this has been replaced by XProtect Remediator, which runs more frequent background scans.
Gatekeeper verifies that applications are signed by identified developers and have not been tampered with. It does not scan for malware directly, but it reduces the risk of running unsigned or modified applications.
These built-in tools provide a baseline level of protection, but they are not comprehensive. They rely on known signatures and cannot detect novel or targeted threats.
Recommended Scanning Tools for Mac Malware Detection
For a thorough check, dedicated malware scanners provide deeper analysis than the built-in macOS protections.
Malwarebytes for Mac is our top recommendation for most users learning how to check for malware on Mac. The free version performs on-demand scans and removes detected threats. It is particularly effective against adware, potentially unwanted programs (PUPs), and browser hijackers – the most common categories of Mac malware. The scan is fast and the interface is straightforward.
ClamXAV is a macOS frontend for the open-source ClamAV engine. It provides real-time scanning and scheduled scans with regularly updated virus definitions. ClamXAV is a solid choice for users who prefer an open-source scanning engine and want continuous monitoring rather than on-demand scans only.
KnockKnock from Objective-See is a free tool that enumerates all persistently installed software on your Mac – Launch Agents, kernel extensions, browser plugins, login items, and more. It does not remove anything, but it provides a comprehensive view of what is running on your system and flags items that are unsigned or from unknown developers.
BlockBlock, also from Objective-See, monitors for persistence mechanisms in real time. It alerts you whenever something attempts to install a persistent component, allowing you to block it before it takes hold.
Terminal Commands for Investigating Suspicious Activity
For more advanced investigation, the Terminal provides powerful tools to check for malware on Mac at a deeper level.
List all open network connections to identify processes communicating with external servers:
lsof -i -P | grep ESTABLISHEDCheck for recently modified files in common malware staging directories:
find /tmp -type f -mtime -7 -ls 2>/dev/null
find ~/Library/Application\ Support -type f -mtime -7 -name "*.app" -ls 2>/dev/nullCheck for suspicious cron jobs:
crontab -l
ls -la /var/at/jobs/Examine DNS configuration for signs of DNS hijacking:
scutil --dns | head -30
cat /etc/hostsIf the /etc/hosts file contains entries redirecting legitimate domains to unfamiliar IP addresses, this is a strong indicator of compromise.
What to Do If You Find Malware
If your investigation confirms a malware infection, take these steps in order:
- Disconnect from the network to prevent further data exfiltration or command-and-control communication
- Document what you found – process names, file paths, network connections – before removing anything
- Run a full scan with Malwarebytes or ClamXAV and quarantine detected threats
- Manually remove any persistence mechanisms (Launch Agents, Login Items) associated with the malware
- Change passwords for any accounts accessed from the infected system, starting with email and financial accounts
- Monitor your accounts for suspicious activity in the following weeks
- Consider a clean macOS reinstall if the infection was severe or if you cannot verify complete removal
Knowing how to check for malware on Mac is not a one-time activity. Establishing a regular scanning schedule – monthly at minimum – combined with safe browsing habits and prompt software updates provides the strongest defense against the growing landscape of macOS threats.