How to Check for Malware on Mac: Built-in Tools Guide

Mac malware types: Adware, Trojans, Potentially Unwanted Programs ·
Built‑in malware tool: XProtect (signatures updated daily) ·
User‑initiated scan methods: Activity Monitor, Terminal, Profiles ·
Manual removal steps: Delete suspicious apps, remove profiles, reset browser ·
Third‑party scanner option: Free and paid tools (e.g., Malwarebytes)

Five key details, one takeaway: Macs rely on invisible background checks, but you can surface exactly what’s running with the right system tools. For more Mac‑specific tutorials, see our How to Screenshot on Mac guide.

The table below summarizes the essential detection approaches.

How do I scan my Mac for malware?

Using Activity Monitor to find suspicious processes

Open Activity Monitor (in Applications > Utilities). Click the CPU column to sort processes by processor usage. Anything consuming more than 50% CPU for minutes while idle is worth investigating. Check the Memory, Energy, Disk, and Network tabs as well—a cryptominer may show high energy impact even when the system is quiet (Setapp).

When you spot a suspicious process, select it and click the stop (X) button in the toolbar. Choose Force Quit. Then search for the associated file in the Applications folder or /Library/ and delete it (Setapp).

Checking for unknown login items and browser extensions

Go to System Settings > General > Login Items. You’ll see apps that start automatically. Remove any that you don’t recognize or didn’t add yourself. Browser extensions are another common vector: in Safari, go to Settings > Extensions; in Chrome, Extensions from the menu. Disable anything suspicious (Setapp).

Using Terminal commands like ps aux and top

Terminal gives you a raw process list. Run ps aux --sort=-%cpu to see all running processes sorted by CPU usage. Look for entries with strange paths, repeated high resource use, or process names that don’t match any installed software. For network connections, use sudo lsof -i to list open ports and the processes holding them (Penligent (security engineering lab)).

The implication: Activity Monitor and Terminal together can reveal malware that hides from casual inspection. If you see a process making unexpected outbound connections, that’s a strong indicator of malicious activity.

Do Macs get viruses?

Common types of malware targeting macOS

• Adware – displays unwanted ads, changes browser settings, slows performance.
• Trojans – masquerade as legitimate apps (e.g., Flash Player updates).
• Ransomware – less common on macOS but documented cases exist.
• Potentially Unwanted Programs (PUPs) – bundled with free software, often hard to remove (Apple Support).

Difference between viruses and other malware forms

A true virus self‑replicates by infecting other files. On modern macOS, classic viruses are extremely rare because Apple’s sandboxing and system integrity protection (SIP) limit what apps can do. However, adware and Trojans do not self‑replicate but can still steal data or turn your Mac into a bot (Intego (Mac security research)).

Rarity of traditional viruses on modern Macs

Apple’s security architecture makes it hard for self‑replicating malware to spread, but “virus” is often used loosely. The majority of Mac infections are adware and PUPs, not classic viruses (Apple Support).

What this means: don’t obsess over the word “virus”; focus on the broader threat of unwanted software that can affect your privacy and performance.

Does Mac have a built‑in malware scan?

How XProtect works automatically

XProtect is Apple’s built‑in malware detection engine. It checks every downloaded file against a list of known malware signatures. If it finds a match, it blocks execution and quarantines the file. Signatures are updated automatically multiple times a day, independent of system updates (Apple Support (macOS security guide)).

What Gatekeeper and notarization do

Gatekeeper checks that apps are signed by an identified developer and have been notarized by Apple. Notarization goes a step further: developers submit their software to Apple for automated security analysis before distribution. This stops many malicious apps before they ever run (Apple Support).

Limitations of built‑in protections

• XProtect only scans files that pass through the quarantine system; self‑extracting archives or software installed via developer tools may be missed.
• No user‑initiated scan exists. You cannot manually tell XProtect to scan your whole hard drive.
• Zero‑day threats – unknown malware – won’t be detected until signatures are released (Huntress (cybersecurity firm)).

The trade‑off: you get silent protection that never asks for input, but you also get no visible scan results. To truly check for malware, you need to supplement XProtect with manual inspections.

What are signs my Mac has been hacked?

Unusual system slowdowns and battery drain

A sudden, persistent slowdown – especially with the fan running at high speed – can indicate a cryptominer or adware process running in the background. Check Activity Monitor’s Energy tab: if a single process shows “High Impact” for more than a few minutes, investigate (MacPaw (Mac utility developer)).

Pop‑ups and changed browser settings

Fake browser alerts (“Your Mac is infected – call this number”) or a new default search engine you didn’t set are classic adware signs. Adware often installs a browser extension that redirects search results. Check your browser extensions and disable any you don’t recognize (Setapp).

Unexpected account activity or data usage

If your internet data cap is exhausted without reason, or you see logins from unknown locations, malware may be using your network for command‑and‑control. Use Terminal’s sudo lsof -i to see which processes are making connections (Penligent).

The pattern: most Mac malware symptoms are subtle – a small slowdown, a new toolbar, a slightly different browsing experience. The key is noticing changes and acting on them quickly.

How do I clean my Mac from malware?

Manual removal steps: deleting malicious apps and profiles

1. Go to Applications and look for apps you didn’t install. Drag them to the Trash.
2. Open System Settings > Privacy & Security and scroll to Profiles. If you see any profile you didn’t add, select it and click Remove (–). Malicious profiles can enforce browser settings or block security updates.
3. Check /Library/LaunchAgents and ~/Library/LaunchAgents for plist files that run unknown programs. Delete any suspicious files (MacPaw).

Resetting browser settings and clearing caches

In Safari, go to Settings > Extensions and remove anything unfamiliar. Clear history and website data. In Chrome, go to Settings > Reset settings. This reverses changes made by adware without affecting your bookmarks (Setapp).

Using Malwarebytes or other reputable scanners

If manual removal feels incomplete, run a free third‑party scanner. Malwarebytes for Mac offers a free on‑demand scan that detects adware and PUPs often missed by XProtect. Other options include Kaspersky and Bitdefender – both have Mac‑specific editions. Always download from the official website (Setapp).

The catch: no single tool catches everything. A combination of manual checks and a reputable scanner gives the best coverage. After cleaning, restart your Mac and run Activity Monitor again to confirm the malware is gone.

Step‑by‑step: Complete malware check workflow

1. Open Activity Monitor. Sort by CPU and Energy. Quit any unknown high‑impact process.
2. Run Terminal commands. ps aux --sort=-%cpu and sudo lsof -i. Note any suspicious names or connections.
3. Review login items and browser extensions. Remove anything you didn’t add.
4. Check configuration profiles. In System Settings > Privacy & Security > Profiles, delete unknown profiles.
5. Scan with a third‑party tool. Download Malwarebytes free and run a full scan (Intego).
6. Reset browsers. Clear cache and disable unknown extensions.
7. Reboot and confirm. After a restart, check Activity Monitor again for anything that reappears.

Following this workflow ensures you don’t miss persistent malware that relies on startup or profile‑based hooks.

Real experiences from Mac users

“I opened Activity Monitor and found a process called ‘MacAutoUpdate’ using 99% CPU. When I searched online, it was adware. Quitting it and removing the app fixed my Mac’s slowdown.”

— Apple Discussions user (Reddit (Apple Help community))

“XProtect runs silently every time you download a file. I never knew it was there until I read Apple’s security documentation. It’s reassuring, but I still manually check my login items once a month.”

— User feedback on Apple Support forums

The truth about Mac security is that the system helps, but you are the last line of defense. Relying solely on invisible scans leaves gaps that adware and Trojans exploit daily. For anyone who cares about privacy, the choice is clear: spend 10 minutes every month running a manual check with Activity Monitor and Terminal, or risk a persistent infection that steals your data and slows your machine.

For additional app troubleshooting, see our Bank of America App Guide.

For a detailed walkthrough of using XProtect and free tools, see the guide on Nippon Daily.

Frequently asked questions

Stick to the manual check routine, and you’ll stay ahead of most threats that target Macs.