How do I know if my Mac has malware in 2026?

The signs are: Activity Monitor shows a process using 90%+ CPU that you did not start, the fans run loud even when no app is open, the browser home page changes, pop-ups appear even when no browser is open, or your Mac runs hot with the lid closed. Run the 8-step detection routine in this guide to confirm; do not assume a single symptom equals malware.

Does my Mac need antivirus software in 2026?

Most home users do not need a third-party antivirus if you keep macOS updated, only install software from the App Store or identified developers, and use a standard user account (not admin) for daily work. Power users and people who install software from outside the App Store should consider a lightweight scanner like Malwarebytes or CleanMyMac for periodic checks.

What is XProtect and does it catch everything?

XProtect is Apple's built-in malware scanner that runs in the background and updates silently. It catches known malware signatures and blocks known-bad apps from launching. XProtect does not catch zero-day malware, targeted attacks, or adware that is technically allowed by the OS. For comprehensive protection, add a periodic third-party scan.

Is the Mac Activity Monitor enough to find malware?

Activity Monitor is the first place to look but it is not enough on its own. Modern malware uses process names that match legitimate Apple processes, runs only briefly, or hides in background daemons that Activity Monitor does not display by default. Use Activity Monitor as a first-line check, then run a scanner like EtreCheck or Malwarebytes to confirm.

Can malware survive a factory reset on a Mac?

In rare cases, yes. Firmware-level malware can survive a macOS reinstall because it lives in the EFI firmware chip, not on the drive. Apple silicon Macs have a reduced attack surface but are not immune. If a clean reinstall does not remove the issue, contact Apple Support or an authorized service provider; you may need a firmware restore via Apple Configurator 2.

What is the best free malware scanner for Mac in 2026?

Malwarebytes Free for Mac is the most widely used free scanner; it catches adware, PUPs, and known malware signatures. EtreCheck Pro is a paid diagnostic tool that surfaces suspicious launch agents, kexts, and kernel extensions. Apple's built-in XProtect plus the 8-step detection routine in this guide is sufficient for most home users.

How do I remove malware from my Mac?

Step 1: disconnect from the network. Step 2: open Activity Monitor and force-quit any suspicious process. Step 3: run Malwarebytes or EtreCheck to identify the malware. Step 4: remove the malicious app and any associated launch agents. Step 5: change passwords from a clean device. Step 6: if the malware persists, back up your data and perform a clean macOS reinstall.

How to Check Your Mac for Malware in 2026 Detection and

At a glance

macOS XProtect blocks known malware signatures but does not catch zero-days, targeted attacks, or adware.

The 8-step detection routine below identifies most Mac malware in 2026 without third-party software.

For a comprehensive scan, use Malwarebytes Free for Mac (catch adware and PUPs) or EtreCheck Pro (diagnose launch agents and kexts).

Most home users do not need a paid antivirus; a periodic third-party scan plus safe install practices is enough.

If the malware persists after removal, back up your data and perform a clean macOS reinstall; firmware-level malware is rare but possible.

macOS is a secure operating system but it is not immune to malware. In 2026, the most common Mac threats are adware and PUPs (potentially unwanted programs), followed by credential stealers, info stealers that target browser passwords, and ransomware that uses macOS-specific execution paths. This guide covers how to check your Mac for malware, the free tools that actually work, and what to do if you find something.

The 2026 Mac malware threat landscape

Mac malware has grown from a curiosity to a real category over the last five years. The 2026 threat landscape is dominated by:

Adware and PUPs: programs that install themselves as browser extensions, change search defaults, or inject ads. The most common 2026 examples are variants of the AdLoad family.
Credential stealers: malware that reads browser-stored passwords and exfiltrates them. Atomic Stealer (AMOS) is the most prevalent 2026 example.
Info stealers: malware that collects browser cookies, cryptocurrency wallet data, and saved credentials. Many target specific apps like 1Password or Authy.
Ransomware: less common on Mac than Windows but growing. The 2026 LockBit variant specifically targets macOS through fake software updates.
Cryptominers: malware that uses your Mac's CPU and GPU to mine cryptocurrency. Often installed through pirated software.

The good news: macOS XProtect catches most known malware signatures and Apple's Gatekeeper prevents unsigned apps from launching by default. The bad news: zero-day malware and targeted attacks slip past both controls. The 8-step detection routine below helps you catch what the built-in controls miss.

The 8-step detection routine

Run this routine on any Mac you suspect may be compromised. It takes 15 to 30 minutes and requires no third-party software.

Step 1: Check Activity Monitor for unfamiliar processes

Open Activity Monitor (Applications > Utilities > Activity Monitor). Click the CPU column to sort by CPU usage. Look for processes that are using a high percentage of CPU and that you did not start. Common legitimate processes (kernel_task, WindowServer, mdworker) use significant CPU and are normal. Suspicious processes often have generic names like helper, update, or service, or are running from /tmp or ~/Library.

Click on the suspicious process and look at the Open Files and Ports tab. This shows the binary location and any open network connections. A process running from /tmp, /private/var/folders, or a folder you do not recognize is a red flag. Note the process name and PID for the next steps.

Open System Settings > General > Login Items. Review the list of items that open at login. Most users have a small number (3 to 8) of legitimate items. A long list of unfamiliar items, or items with names like helper, update, or service, are suspicious. Click the minus button to remove any item you do not recognize.

Step 3: Check Launch Agents and Launch Daemons

Open Finder and navigate to ~/Library/LaunchAgents. This folder contains user-level launch agents that run when you log in. Look for .plist files with names you do not recognize. Each .plist file is a script or binary that runs at login. Common malware locations include com.helper.plist, com.update.plist, and com.service.plist.

Do the same for /Library/LaunchAgents (system-wide) and /Library/LaunchDaemons (system daemons that run at boot). Any .plist file with a generic name or a recent modification date is worth investigating. Right-click and choose Open With > TextEdit to see what the file runs.

Open System Settings > Privacy & Security > Profiles. If you see profiles you did not install (typically MDM profiles pushed by an employer or school), they could be the source of unwanted behavior. Remove any profile you do not recognize. Note: legitimate profiles will re-install if they are managed by your employer.

Step 5: Check Browser Extensions

Open your browser and review the installed extensions. In Safari, open Safari > Settings > Extensions. In Chrome, navigate to chrome://extensions. In Firefox, navigate to about:addons. Review the list and remove any extension you did not install or that you do not use. Pay particular attention to extensions that claim to be PDF converters, search enhancers, or shopping assistants; these are common malware vectors.

Open Activity Monitor and click the Energy tab. Look for processes with High Energy Impact that you did not start. Click on each and check the Open Files and Ports tab. If the process is running from a system folder (/System, /usr/libexec) and has a signed Apple developer ID, it is likely legitimate. If it is running from a user folder, /tmp, or an unrecognized location, it is suspicious.

Step 7: Check Network Activity

Open Activity Monitor and click the Network tab. Look for processes that are sending or receiving significant data and that you do not recognize. The process name and the binary location are the key indicators. Common legitimate network users are cloud storage sync clients, browser processes, and system update processes. Anything else sending significant data is worth investigating.

Step 8: Check for Unknown Applications

Open Finder and navigate to /Applications. Review the list of installed applications. Remove any application you do not recognize or that you did not install. Also check ~/Applications (user-level), /Library/Application Support, and ~/Library/Application Support. The Application Support folders are common hiding places for malware because they are not visible in the standard Applications view.

Free tools that actually work

For a comprehensive scan, use one or both of these free tools.

Malwarebytes Free for Mac is the most widely used free Mac malware scanner. Download from malwarebytes.com (not from any other source). Run a full scan; it takes 15 to 30 minutes. Malwarebytes catches adware, PUPs, and known malware signatures that XProtect misses. The free version does not include real-time protection but is sufficient for periodic scans.

EtreCheck Pro is a paid diagnostic tool (free trial available) that surfaces the kind of system information the 8-step routine covers: launch agents, kexts, kernel extensions, network connections, and resource usage. EtreCheck is particularly useful for diagnosing subtle infections where the malware is hiding in an obscure launch agent or a configuration profile.

For a more thorough scan, run both: Malwarebytes for known signatures, EtreCheck for system-level anomalies. If both come up clean, your Mac is almost certainly not compromised.

What to do if you find malware

If the 8-step routine or a scanner flags a suspicious process or file, take these steps in order.

Disconnect from the network. Turn off Wi-Fi and unplug the Ethernet cable. This prevents the malware from exfiltrating more data or downloading additional payloads.
Force-quit the suspicious process. Open Activity Monitor, select the process, click the X button, and choose Force Quit. Note the binary location from the Open Files and Ports tab.
Run a full malware scan. Run Malwarebytes and EtreCheck. Note everything they flag, including file paths and detection names.
Remove the malicious app and any associated files. Delete the app from /Applications or ~/Applications. Check the launch agent and launch daemon folders for related .plist files and delete them. Empty the Trash.
Restart in safe mode. Hold Shift during boot to start in safe mode. This loads only essential kernel extensions and disables most third-party launch agents. Run the scanners again to confirm the malware is gone.
Change passwords from a clean device. Use a different computer (not the infected one) to change the passwords for any accounts that may have been exposed: email, banking, social media, work accounts. Enable two-factor authentication where possible.
Check for persistent access. Review Login Items, Profiles, and Launch Agents one more time. Malware that has been active for a long time often installs multiple persistence mechanisms.

When to do a clean reinstall

If the malware persists after removal, or if the symptoms continue after a full scan and clean removal, back up your data and perform a clean macOS reinstall. The clean reinstall process:

Back up your data using Time Machine or another backup tool. Do not back up applications; only back up documents, photos, and other data files.
Back up browser bookmarks and passwords separately.
Restart the Mac and hold Command + R to enter macOS Recovery.
Choose Disk Utility and erase the startup drive.
Choose Reinstall macOS.
After the reinstall, install only the applications you trust, restore your data, and re-enable browser sync.

A clean reinstall is the most thorough way to remove persistent malware. It is also the most time-consuming (2 to 4 hours including data restoration). For most users, the 8-step routine plus a Malwarebytes scan is sufficient. A clean reinstall is a last resort.

What about firmware-level malware?

Firmware-level malware lives in the EFI (Extensible Firmware Interface) chip on the logic board, not on the storage drive. It runs before macOS boots and can survive a clean reinstall. Apple silicon Macs have a reduced attack surface, but they are not immune.

If you have completed the 8-step routine, run Malwarebytes, and performed a clean reinstall, and the symptoms persist, contact Apple Support or an authorized service provider. You may need a firmware restore via Apple Configurator 2, which requires a second Mac and the original USB-C cable. This is rare but it happens; the 2018 Pegasus / Thunderstrike 2 disclosure proved that firmware-level Mac malware is possible.

How to avoid Mac malware in 2026

The 2026 best practices for avoiding Mac malware are simple:

Keep macOS updated. Apple ships security updates regularly; install them within 2 weeks of release.
Only install software from the App Store or identified developers. If you must install software from outside the App Store, verify the developer's identity and download from the official site, not from a search result.
Use a standard user account for daily work. Admin accounts let malware install persistent components. A standard account makes it harder for malware to gain persistence.
Don't disable Gatekeeper. Gatekeeper's default setting is to only allow apps from identified developers. Do not override it unless you have a specific reason and trust the developer.
Be skeptical of browser pop-ups and email attachments. The most common Mac malware delivery mechanism is a browser pop-up that says your Mac is infected, or a fake software update in an email attachment.
Use a password manager. Browser-stored passwords are the most common target of Mac credential stealers. A password manager with a strong master password reduces the blast radius of a single breach.

Source: Apple macOS User Guide: Protect your Mac from malware (2026 edition); Malwarebytes 2026 State of Mac Malware Report; EtreCheck Pro documentation; Apple Platform Security Guide (May 2026); independent testing by AV-TEST and AV-Comparatives for 2026.

Mac malware check 2026 buyer FAQ

How do I know if my Mac is being monitored? Look for unfamiliar processes in Activity Monitor, especially ones with generic names running from /tmp or ~/Library. Check for unknown Login Items and Profiles. Run a Malwarebytes scan; the scanner flags monitoring and surveillance software explicitly.

Can my Mac webcam be hacked? Yes. The 2019 Fruitfly malware and the 2021 UpdateAgent variants specifically targeted Mac webcams. The Mac's green LED next to the camera should be on whenever the camera is active; if it is off and you suspect the camera is on, run the 8-step routine. Cover the camera when not in use.

How do I check for Mac keyloggers? Run EtreCheck Pro; it surfaces installed launch agents and daemons, which is where most keyloggers hide. Also check ~/Library/LaunchAgents and /Library/LaunchAgents for unfamiliar .plist files. Look for any .plist that runs a binary from /tmp or a system folder that is not /System or /usr/libexec.

Does the Mac built-in scanner work in 2026? Yes, but it is not enough on its own. XProtect catches known malware signatures and Gatekeeper prevents unsigned apps from launching, but XProtect does not catch zero-day malware, targeted attacks, or adware. For a comprehensive check, combine XProtect with a periodic Malwarebytes scan.

What is the difference between a virus and malware on Mac? A virus is a specific type of malware that replicates itself. In 2026, most Mac malware is not technically a virus; it is adware, PUP, credential stealer, info stealer, or ransomware. The term "malware" covers all of these; "virus" is a subset.

Should I pay for Mac antivirus in 2026? For most home users, no. The combination of XProtect, Gatekeeper, a standard user account, and a periodic Malwarebytes scan is sufficient. Power users, business users, and people who install software from outside the App Store may benefit from a paid product. If you are buying a paid product, look for one that scores well in independent testing (AV-TEST, AV-Comparatives).

How do I know if my Mac camera or microphone is on? macOS shows a green dot next to the camera when it is active, and an orange dot in the menu bar when the microphone is in use. If either indicator is on when you are not actively using the camera or microphone, run the 8-step routine to find the process responsible.

#how to check malware on mac#mac malware check#mac virus scan#mac activity monitor#mac security 2026

Written by

Fazlur RahmanAI, Entrepreneurship, EdTech

Fazlur Rahman is the founder of Tutorsbot, building AI-powered tools for learning and career growth. He writes about applying AI in real products and the practi… Read more

Fazlur Rahman is the founder of Tutorsbot, building AI-powered tools for learning and career growth. He writes about applying AI in real products and the practical side of building an ed-tech startup.

How to Check Your Mac for Malware in 2026 Detection and

The 2026 Mac malware threat landscape

The 8-step detection routine

Step 1: Check Activity Monitor for unfamiliar processes