How to scan Mac for malware
If your Mac is running slowly, showing pop-ups, or behaving strangely, a malware check is a smart first step.
This guide explains how to scan Mac for malware using built-in protections, trusted security tools, and manual checks that help you find suspicious activity fast.
macOS includes strong defenses such as XProtect, Gatekeeper, and notarization, but no platform is immune to adware, trojans, browser hijackers, or phishing-driven compromise.
Knowing what to scan, where to look, and how to confirm cleanup can save time and reduce risk.
What malware on a Mac can look like
Not every Mac problem is caused by malware, but certain patterns should raise concern.
Common symptoms include unusual browser redirects, new toolbars, repeated permission prompts, sudden performance drops, unexpected battery drain, and apps you do not remember installing.
- Frequent pop-ups, especially in Safari, Chrome, or Firefox
- Unknown login items or background processes
- Homepage or search engine changes in a browser
- Mac fan activity or CPU usage that stays high without a clear reason
- Security alerts from unfamiliar software
- Documents, downloads, or browser extensions you did not add
Adware often focuses on advertising and tracking, while spyware, ransomware, and trojans are more dangerous.
The type of threat matters because cleanup steps and urgency can differ.
Start with built-in Mac security checks
Before installing anything, use the protections already included in macOS.
Apple’s built-in tools are designed to detect known malware, block unsigned apps, and warn you about unsafe behavior.
Check for macOS updates
Open System Settings, go to General, then Software Update.
Installing the latest macOS version and security updates helps patch vulnerabilities and refresh Apple’s malware definitions.
Review Gatekeeper and app permissions
Gatekeeper helps prevent untrusted software from launching.
If you recently allowed an app from an unknown developer, review it carefully in System Settings under Privacy & Security.
Remove any software that looks suspicious or was installed without clear purpose.
Use Activity Monitor
Open Activity Monitor and look for processes using unusually high CPU, memory, or energy.
Malware sometimes hides behind generic names or consumes resources in the background.
If you find an unfamiliar process, search its name before force quitting it.
How to scan Mac for malware with a trusted security app
For a deeper check, run a reputable anti-malware or antivirus scan.
A good scanner can detect adware, browser hijackers, trojans, and potentially unwanted programs that built-in tools may not fully remove.
Choose a reputable scanner
Use software from a known security vendor with regular definition updates and clear privacy policies.
Look for features such as real-time protection, scheduled scanning, quarantine, and browser extension review.
Avoid “cleaner” apps that make bold claims but have poor reviews or questionable behavior.
Run a full system scan
Install the software, update its definitions, and run a full scan of the Mac.
Full scans take longer than quick scans, but they examine applications, downloads, system locations, and common persistence areas more thoroughly.
Review detections carefully
After the scan finishes, quarantine or remove any items flagged as malicious or potentially unwanted.
If the tool identifies browser extensions, launch agents, or login items, inspect those results closely because they can help explain ongoing problems.
Where malware commonly hides on macOS
Malware on a Mac often tries to persist by placing files in startup or configuration locations.
Knowing where to look helps you verify whether a scanner found everything.
- Login Items: Apps set to open automatically when you sign in
- Launch Agents and Launch Daemons: Background services that start at login or boot
- Applications folder: Rogue apps disguised as utilities or installers
- Browser extensions: Add-ons that change search settings or inject ads
- Downloads folder: Installers, disk images, and archives that were never removed
You can inspect login items in System Settings under General and then Login Items.
If something unfamiliar appears there, remove it and scan again.
How to check browsers for hijackers and adware
Browser hijackers are among the most common Mac threats because they alter your search engine, homepage, or new tab page.
Even after you remove the main app, the browser may still be affected.
Safari
In Safari, review Extensions, Website Notifications, and Search settings.
Remove extensions you do not recognize and reset website permissions that keep triggering pop-ups.
Google Chrome
In Chrome, open Extensions and remove suspicious add-ons.
Then check Settings for startup pages, default search engine, and notifications.
If the browser keeps redirecting, resetting Chrome may be faster than manual cleanup.
Mozilla Firefox
In Firefox, inspect Add-ons and themes, then review Search and Home settings.
Firefox also supports a refresh process that removes many unwanted changes while preserving useful data.
Manual cleanup steps after a malware scan
If a scan finds threats, or if the Mac still acts strangely afterward, complete a manual cleanup.
This is especially important for adware that changes browser settings or installs hidden support files.
- Delete suspicious applications from the Applications folder.
- Remove unknown login items in System Settings.
- Delete unwanted browser extensions and reset browser settings.
- Empty the Trash.
- Restart the Mac and run a second full scan.
If you know the threat involved a fake update, installer, or cracked software package, remove the original disk image, zip file, or installer from Downloads as well.
Reintroducing the same file can bring the problem back.
When to use Safe Mode or Recovery
Some threats are harder to remove when macOS starts normally.
Booting into Safe Mode limits startup items and can help isolate unwanted behavior.
If a threat keeps returning, macOS Recovery can help you reinstall the operating system without erasing your personal files in many cases.
Use Recovery only after you have identified the issue and confirmed your backups.
Time Machine backups are valuable, but you should avoid restoring suspicious files or apps from a backup that may contain the same threat.
How to prevent malware on a Mac
Prevention is usually easier than cleanup.
Most Mac infections begin with software downloads, fake update prompts, phishing messages, or permission mistakes.
- Download apps only from the Mac App Store or official vendor sites
- Keep macOS and all browsers updated
- Avoid cracked apps, pirated installers, and “free” utility bundles
- Do not approve pop-up requests for permissions without verifying the source
- Use strong passwords and two-factor authentication for Apple ID and important accounts
- Review browser extensions and login items regularly
Consider enabling automatic updates so security fixes install promptly.
If you share a Mac or manage multiple devices, a routine scan schedule helps catch adware before it spreads through synced browsers or shared accounts.
What to do if the scan finds nothing but the problem continues
If your malware scan comes back clean, the issue may still be caused by a damaged app, failing hardware, browser cache corruption, or a non-malware privacy problem.
Recheck startup items, extensions, and network settings.
If necessary, try a second opinion from another reputable scanner because no single tool detects everything.
Persistent symptoms such as constant redirects, unapproved VPN profiles, unusual calendar invites, or repeated credential prompts can also indicate account compromise rather than a local infection.
In that case, change passwords from a clean device and review Apple ID, email, and browser sync settings.
Signs it is time to get help
If malware keeps reinstalling, if your Mac is encrypting files, or if you cannot access important accounts, seek professional help quickly.
Security experts can examine launch agents, system logs, network traffic, and persistence mechanisms that are easy to miss during a basic scan.
For business Macs, involve your IT or security team immediately.
Endpoint security platforms, MDM tools, and incident response processes can help contain the threat and prevent spread to other devices.