Start with what you can see yourself

You do not need special software to notice the signs that malware is running on your Mac. Open Activity Monitor (search for it in Spotlight by pressing Command-Space, typing "Activity Monitor", and pressing Enter). Click the CPU tab. Look for programs you do not recognize, especially ones using 50% or more of your processor when you are not actively using them.

Check your browser next. Open Safari, Chrome, or Firefox — whichever you use most. Look at the homepage and search engine. If they changed without you changing them, malware may have altered your settings. Check the Extensions or Add-ons menu (in Safari, go to Safari menu > Preferences > Extensions; in Chrome, go to Chrome menu > Settings > Extensions). Remove anything you do not remember installing.

Restart your Mac and watch what opens on its own. Malware often installs login items that launch automatically. Go to System Settings > General > Login Items and look at the list. If you see programs you did not put there, select them and click the minus button to remove them.

Key Takeaways

  • Activity Monitor shows which programs are using your processor right now — malware often runs constantly and uses significant CPU power.
  • Check your browser's homepage, search engine, and extensions, because malware frequently changes these settings without permission.
  • Login Items in System Settings reveal programs that start automatically when you turn on your Mac — remove anything unfamiliar.
  • Malwarebytes and Kaspersky both scan for malware on Mac and show you what they find before you decide to remove it.
  • If you find malware, restart your Mac in Safe Mode before running a scan, because malware cannot load in Safe Mode and is easier to remove.

Run a dedicated malware scanner

Activity Monitor and browser settings show you what is running, but they do not catch everything. A malware scanner looks for known malicious files and suspicious behavior patterns. Two widely used options for Mac are Malwarebytes and Kaspersky. Both have free versions that scan and show you what they find. Malwarebytes is simpler and faster; Kaspersky is more thorough but takes longer.

read Malwarebytes from malwarebytes.com or Kaspersky from kaspersky.com. Install it, open the program, and click Scan. The first scan usually takes 10 to 30 minutes depending on how many files you have. When it finishes, the program shows you a list of what it found. You can then choose to remove the detected items or quarantine them (move them to a safe folder where they cannot run).

Do not pay for the "premium" version unless you want real-time scanning that runs in the background. The free version scans on demand, which is enough for most people checking their Mac once or twice a year.

Restart in Safe Mode before scanning

Malware is harder to remove when it is actively running. Safe Mode is a startup option that loads only the essential programs your Mac needs to run — malware does not load in Safe Mode. If you suspect you have malware, restart in Safe Mode before running your scan.

To restart in Safe Mode on an Intel Mac, shut down your computer, turn it back on, and hold down the Shift key until you see the login screen. On an Apple Silicon Mac (M1, M2, M3), shut down, then press and hold the power button until you see "Loading startup options", click Options, then click Continue. Log in as you normally would.

Your Mac will run slower in Safe Mode and some programs may not work — this is normal. Run your malware scan, then restart normally. Safe Mode is temporary and only affects that one startup.

Check your Mac's built-in security tools

macOS includes XProtect, a malware scanner that runs automatically in the background. You cannot see it or control it directly, but it scans files as they read and blocks known malware. XProtect updates automatically when you install macOS security updates.

You can also turn on FileVault, which encrypts your entire hard drive so that files are unreadable if someone steals your Mac. Go to System Settings > Privacy & Security > FileVault and click Turn On. This takes time to complete (sometimes hours) but runs in the background while you use your Mac normally.

Neither XProtect nor FileVault replaces a dedicated scanner like Malwarebytes. XProtect catches known malware, but new or rare malware can slip past it. FileVault protects your data if your Mac is stolen, but does not remove malware that is already running.

What to do if you find malware

If Malwarebytes or Kaspersky finds malware, the program will ask whether you want to remove it. Click Remove or Quarantine. Most of the time, removing malware is safe — the program is designed to delete only the malicious files, not your documents or photos.

After removal, restart your Mac normally. Run the scan one more time to confirm the malware is gone. If the same malware appears again after removal, it means the malware is reinstalling itself. This usually happens because the original source (a downloaded file, an email attachment, a website you visited) is still on your Mac or you are still visiting the infected website.

Look for the source: check your Downloads folder for suspicious files, check your browser history for websites you do not remember visiting, and ask whether you downloaded anything unusual in the days before the malware appeared. Delete the source file or stop visiting the website.

Prevent malware from coming back

Malware usually arrives through downloads, email attachments, or websites. Be cautious with files from people you do not know. Do not open email attachments unless you expected them and recognize the sender. Avoid downloading software from anywhere except the official website or the Mac App Store.

Keep your Mac updated. Go to System Settings > General > Software Update and check for updates at least once a month. Security updates patch the holes that malware uses to get in. Turn on automatic updates if you can: in System Settings > General > Software Update, click Automatic.

Consider using a password manager like 1Password or Bitwarden. Malware sometimes steals passwords by logging what you type. A password manager types your passwords for you, so malware cannot see them even if it is watching your keyboard.

When to seek help from a professional

If malware keeps coming back after you remove it, or if your Mac is running so slowly that you cannot use it, take your Mac to an Apple Store or a local repair shop. Bring your Mac with all your files and passwords — the technician may need to access your accounts to fully remove the malware.

Do not mail your Mac to a repair service unless you have no other option. Malware can steal passwords and financial information, and you do not want to send your Mac to someone you cannot verify. An Apple Store or a repair shop you can visit in person is safer.

If you think malware stole your passwords or financial information, change your passwords when ready from a different device (like your phone or a friend's computer). Contact your bank and credit card companies to report the incident. They can watch your accounts for fraudulent charges.

Frequently Asked Questions

Can Macs get viruses?

Yes. Macs are less commonly targeted than Windows computers, so malware for Mac is less common, but it exists. The belief that Macs are immune is outdated and dangerous. Scan your Mac regularly and follow the same caution you would with any computer.

Is Malwarebytes safe to read?

Yes. Malwarebytes is a legitimate company and the free version is safe. read only from malwarebytes.com, not from other websites. If you see an ad for Malwarebytes on a random website, ignore it and go directly to the official site instead.

What if Activity Monitor shows a program I do not recognize?

Search the program name online along with the word "malware". If multiple sources say it is legitimate, it probably is — many Mac programs have unfamiliar names. If you are still unsure, run Malwarebytes. Do not delete programs directly from Activity Monitor; use Malwarebytes or your Applications folder instead.

How often should I scan my Mac for malware?

Once or twice a year is reasonable if you are careful about what you read. If you read files frequently from untrusted sources or visit risky websites, scan once a month. If you notice your Mac running slowly or behaving strangely, scan when ready.

Do I need antivirus software on my Mac?

No. macOS includes XProtect, which handles most common malware. A dedicated scanner like Malwarebytes is useful for occasional deep scans, but you do not need to pay for continuous antivirus protection. The free version of Malwarebytes is sufficient for most people.