How to Find and Remove Malware on Mac

This guide shows you how to check your Mac for malware, remove anything suspicious, and prevent future infections. You’ll learn where malware hides, which built-in tools to use, and when to consider third-party scanners. No technical background is needed—just follow the steps in order.

What You’ll Need

Your Mac’s admin password (required for most removal steps)
A stable internet connection (for updates and downloads)
About 30–60 minutes of uninterrupted time
Optional: a reputable malware scanner (free trials are fine)

Step-by-Step

Update macOS and all apps. Go to System Settings > General > Software Update and install any pending updates. Then open the App Store and click Updates in the bottom-left to update all apps. Outdated software often has security holes that malware exploits.
Check Activity Monitor for suspicious processes. Open Activity Monitor (in Applications > Utilities). Click the CPU tab and look for processes you don’t recognize, especially ones using high CPU or memory. Malware often runs constantly, so a process pegging the CPU is a red flag. If you see something odd, note the exact name.
Review your Login Items. Go to System Settings > General > Login Items. Look through the list under Open at Login. Anything you didn’t install yourself (e.g., a random “Helper” or “Updater”) could be malware. Select it and click the minus button to remove it.
Inspect browser extensions. In Safari, go to Settings > Extensions (or Safari > Settings > Extensions). In Chrome, go to More tools > Extensions; in Firefox, Add-ons > Extensions. Remove any extension you didn’t install or that you don’t use. Malicious extensions often change your homepage or search engine.
Check your Downloads and Applications folders. Open Finder and go to Downloads. Look for files you don’t remember downloading (e.g., “installer.dmg”, “flash_player.pkg”). Also open Applications and sort by date added. If you see an app you never installed, drag it to the Trash.
Run a malware scanner. If you haven’t already, download a reputable scanner like Malwarebytes (free version is fine). Open it, click Scan, and let it finish. It will list any detected threats. Follow the app’s instructions to quarantine or remove them.
Delete the offending files manually. If you found a specific process or app, use Finder > Go > Go to Folder and type ~/Library/LaunchAgents. Look for plist files related to the malware (e.g., the process name). Also check /Library/LaunchAgents and /Library/LaunchDaemons. Drag any suspicious files to the Trash.
Clear browser data. In your browser’s settings, clear cache, cookies, and site data. This removes any scripts or trackers the malware left behind. Be aware you’ll be logged out of most sites.
Empty the Trash and restart. Right-click the Trash icon and choose Empty Trash. Then restart your Mac. After restart, run the malware scanner again to confirm everything is clean.
Change your passwords. If you suspect malware stole credentials, change your Apple ID password, email passwords, and any banking or social media passwords. Use a different device if possible.

Common Mistakes

Skipping the update step. Running an outdated macOS makes it much easier for malware to re-infect your Mac.
Deleting system files by mistake. If you’re not sure what a file does, don’t delete it. Search the name online first.
Only checking the Applications folder. Malware often hides in ~/Library or as a browser extension.
Ignoring the “Allow” popup. Some malware asks for permission that looks legit. Always read the prompt and deny if you didn’t initiate it.
Not restarting after removal. Some malware processes restart themselves if you don’t reboot.

Tips

Use Gatekeeper. In System Settings > Privacy & Security, ensure “Allow apps from the App Store and identified developers” is selected. This blocks unsigned apps.
Keep FileVault on. It encrypts your disk, making it harder for malware to tamper with system files.
Download only from official sources. Avoid “cracked” software or random download sites; they’re the top malware vector.
Regularly review your browser’s homepage and search engine. If they change without your action, you likely have adware.
Turn on automatic updates. In Software Update settings, check “Install macOS updates” and “Install app updates from the App Store.”

Troubleshooting

Malware scanner finds nothing, but you still see symptoms. Try a second scanner (e.g., CleanMyMac X or Bitdefender). Also check Activity Monitor for a process using 100% CPU and search its name online.
You can’t delete a file because it’s “in use.” Quit the associated app first. If that fails, restart your Mac in Safe Mode (hold Shift while booting) and try again.
Your browser keeps redirecting to ads. Reset your browser settings to default. In Safari, go to Settings > Privacy and click “Manage Website Data,” then remove all. In Chrome, go to Settings > Reset and clean up > Restore settings to their original defaults.
Malware returns after removal. It may be embedded in a LaunchAgent. Check ~/Library/LaunchAgents and /Library/LaunchAgents for plist files with recent modification dates. Delete any that reference the malware.
You suspect a serious infection (e.g., ransomware). Disconnect from the internet, back up only your personal documents to an external drive, then erase your Mac and reinstall macOS via Recovery Mode. This is the nuclear option but guarantees removal.

Frequently Asked Questions

Can Macs get malware? Yes, though less frequently than Windows. Macs can get adware, spyware, and even ransomware, especially if you download from untrusted sources.

Is the built-in XProtect enough? XProtect catches known malware, but it’s not real-time. It runs when you open files, so new or unknown threats may slip through. A third-party scanner is a good extra layer.

How do I know if my Mac is infected? Common signs: sudden slowdowns, browser redirects, pop-ups, new toolbars, or apps you didn’t install. Also check Activity Monitor for unknown processes.

Will removing malware delete my files? No, if you only remove the malicious files and apps. However, clearing browser data will log you out of websites.

Should I pay for a malware removal tool? Free versions of reputable tools like Malwarebytes are sufficient for removal. Paid versions add real-time protection, but you can enable similar protection with macOS’s built-in firewall and safe browsing habits.

What if I can’t afford a new Mac after a malware attack? Malware rarely damages hardware. The steps above should remove it. If you’re still worried, back up your data and reinstall macOS from Recovery—it’s free and doesn’t require a new computer.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →