Step 8: Check for Unknown Applications
Open Finder and navigate to /Applications. Review the list of installed applications. Remove any application you do not recognize or that you did not install. Also check ~/Applications (user-level), /Library/Application Support, and ~/Library/Application Support. The Application Support folders are common hiding places for malware because they are not visible in the standard Applications view.
For a comprehensive scan, use one or both of these free tools.
Malwarebytes Free for Mac is the most widely used free Mac malware scanner. Download from malwarebytes.com (not from any other source). Run a full scan; it takes 15 to 30 minutes. Malwarebytes catches adware, PUPs, and known malware signatures that XProtect misses. The free version does not include real-time protection but is sufficient for periodic scans.
EtreCheck Pro is a paid diagnostic tool (free trial available) that surfaces the kind of system information the 8-step routine covers: launch agents, kexts, kernel extensions, network connections, and resource usage. EtreCheck is particularly useful for diagnosing subtle infections where the malware is hiding in an obscure launch agent or a configuration profile.
For a more thorough scan, run both: Malwarebytes for known signatures, EtreCheck for system-level anomalies. If both come up clean, your Mac is almost certainly not compromised.
What to do if you find malware
If the 8-step routine or a scanner flags a suspicious process or file, take these steps in order.
- Disconnect from the network. Turn off Wi-Fi and unplug the Ethernet cable. This prevents the malware from exfiltrating more data or downloading additional payloads.
- Force-quit the suspicious process. Open Activity Monitor, select the process, click the X button, and choose Force Quit. Note the binary location from the Open Files and Ports tab.
- Run a full malware scan. Run Malwarebytes and EtreCheck. Note everything they flag, including file paths and detection names.
- Remove the malicious app and any associated files. Delete the app from /Applications or ~/Applications. Check the launch agent and launch daemon folders for related .plist files and delete them. Empty the Trash.
- Restart in safe mode. Hold Shift during boot to start in safe mode. This loads only essential kernel extensions and disables most third-party launch agents. Run the scanners again to confirm the malware is gone.
- Change passwords from a clean device. Use a different computer (not the infected one) to change the passwords for any accounts that may have been exposed: email, banking, social media, work accounts. Enable two-factor authentication where possible.
- Check for persistent access. Review Login Items, Profiles, and Launch Agents one more time. Malware that has been active for a long time often installs multiple persistence mechanisms.
When to do a clean reinstall
If the malware persists after removal, or if the symptoms continue after a full scan and clean removal, back up your data and perform a clean macOS reinstall. The clean reinstall process:
- Back up your data using Time Machine or another backup tool. Do not back up applications; only back up documents, photos, and other data files.
- Back up browser bookmarks and passwords separately.
- Restart the Mac and hold Command + R to enter macOS Recovery.
- Choose Disk Utility and erase the startup drive.
- Choose Reinstall macOS.
- After the reinstall, install only the applications you trust, restore your data, and re-enable browser sync.
A clean reinstall is the most thorough way to remove persistent malware. It is also the most time-consuming (2 to 4 hours including data restoration). For most users, the 8-step routine plus a Malwarebytes scan is sufficient. A clean reinstall is a last resort.
What about firmware-level malware?
Firmware-level malware lives in the EFI (Extensible Firmware Interface) chip on the logic board, not on the storage drive. It runs before macOS boots and can survive a clean reinstall. Apple silicon Macs have a reduced attack surface, but they are not immune.
If you have completed the 8-step routine, run Malwarebytes, and performed a clean reinstall, and the symptoms persist, contact Apple Support or an authorized service provider. You may need a firmware restore via Apple Configurator 2, which requires a second Mac and the original USB-C cable. This is rare but it happens; the 2018 Pegasus / Thunderstrike 2 disclosure proved that firmware-level Mac malware is possible.
How to avoid Mac malware in 2026
The 2026 best practices for avoiding Mac malware are simple:
- Keep macOS updated. Apple ships security updates regularly; install them within 2 weeks of release.
- Only install software from the App Store or identified developers. If you must install software from outside the App Store, verify the developer's identity and download from the official site, not from a search result.
- Use a standard user account for daily work. Admin accounts let malware install persistent components. A standard account makes it harder for malware to gain persistence.
- Don't disable Gatekeeper. Gatekeeper's default setting is to only allow apps from identified developers. Do not override it unless you have a specific reason and trust the developer.
- Be skeptical of browser pop-ups and email attachments. The most common Mac malware delivery mechanism is a browser pop-up that says your Mac is infected, or a fake software update in an email attachment.
- Use a password manager. Browser-stored passwords are the most common target of Mac credential stealers. A password manager with a strong master password reduces the blast radius of a single breach.
Source: Apple macOS User Guide: Protect your Mac from malware (2026 edition); Malwarebytes 2026 State of Mac Malware Report; EtreCheck Pro documentation; Apple Platform Security Guide (May 2026); independent testing by AV-TEST and AV-Comparatives for 2026.
How to check for malware on Mac: FAQ
How do I know if my Mac is being monitored? Look for unfamiliar processes in Activity Monitor, especially ones with generic names running from /tmp or ~/Library. Check for unknown Login Items and Profiles. Run a Malwarebytes scan; the scanner flags monitoring and surveillance software explicitly.
Can my Mac webcam be hacked? Yes. The 2019 Fruitfly malware and the 2021 UpdateAgent variants specifically targeted Mac webcams. The Mac's green LED next to the camera should be on whenever the camera is active; if it is off and you suspect the camera is on, run the 8-step routine. Cover the camera when not in use.
How do I check for Mac keyloggers? Run EtreCheck Pro; it surfaces installed launch agents and daemons, which is where most keyloggers hide. Also check ~/Library/LaunchAgents and /Library/LaunchAgents for unfamiliar .plist files. Look for any .plist that runs a binary from /tmp or a system folder that is not /System or /usr/libexec.
Does the Mac built-in scanner work in 2026? Yes, but it is not enough on its own. XProtect catches known malware signatures and Gatekeeper prevents unsigned apps from launching, but XProtect does not catch zero-day malware, targeted attacks, or adware. For a comprehensive check, combine XProtect with a periodic Malwarebytes scan.
What is the difference between a virus and malware on Mac? A virus is a specific type of malware that replicates itself. In 2026, most Mac malware is not technically a virus; it is adware, PUP, credential stealer, info stealer, or ransomware. The term "malware" covers all of these; "virus" is a subset.
Should I pay for Mac antivirus in 2026? For most home users, no. The combination of XProtect, Gatekeeper, a standard user account, and a periodic Malwarebytes scan is sufficient. Power users, business users, and people who install software from outside the App Store may benefit from a paid product. If you are buying a paid product, look for one that scores well in independent testing (AV-TEST, AV-Comparatives).
How do I know if my Mac camera or microphone is on? macOS shows a green dot next to the camera when it is active, and an orange dot in the menu bar when the microphone is in use. If either indicator is on when you are not actively using the camera or microphone, run the 8-step routine to find the process responsible.
Fazlur Rahman
