How to tell if your Mac has a virus

Check six places: what starts with your Mac, which apps have special permissions, device profiles, browser extensions, the startup folders and Activity Monitor. Mac malware has to show up in at least one of them to keep running. Something you didn’t install in any of them is the clearest sign there is.

Strictly, Mac viruses are rare. What people actually run into is other malware: adware that takes over the browser, password stealers, and remote-access tools. The checks below cover all three.

A slow, hot or noisy Mac is a weak sign on its own. Spotlight indexing, Photos analysis, iCloud sync and backups cause the same thing far more often. Step 6 shows how to tell the difference.

What macOS already checks

Every Mac has a built-in malware check called XProtect. Apple says it checks apps for known malware when they first open and when they change, and that macOS downloads new XProtect rules automatically. A separate part of macOS looks for known infections in the background and removes them.

If XProtect finds known malware, you see an alert naming the file, with an option to move it to the Trash. That alert means macOS caught it.

1. Open System Settings > General > Software Update.
2. Click the info button next to Automatic updates.
3. Make sure Install Security Responses and system files is on.

XProtect only knows malware Apple has already seen. The checks below look for anything that doesn’t belong, known or not.

1. Check what starts with your Mac

Malware almost always sets itself up to start again after a restart.

1. Open System Settings > General > Login Items & Extensions.
2. Under Open at Login, look for apps you don’t recognize.
3. Under App Background Activity, look at each name.

macOS lists background items by developer, such as “Google LLC” or “Zoom Video Communications, Inc.”. An entry with a random-looking name, or one you can’t link to anything you installed, needs a closer look. Search the developer’s name, and turn the entry off if you can’t place it.

2. Check which apps can see your screen and files

Password stealers and remote-access tools need permission to read the screen, the keyboard or your files. macOS asks you before any app gets these.

1. Open System Settings > Privacy & Security.
2. Open Accessibility, Input Monitoring, Screen & System Audio Recording and Full Disk Access in turn.
3. Check that every app listed is one you gave access to on purpose.

If you find one you don’t recognize, turn its switch off. Search its name before you turn it back on.

3. Check for device profiles

A configuration profile can change your browser, DNS or proxy settings, and some adware installs one to keep its changes.

1. Open System Settings > General > Device Management.
2. On a personal Mac this list is usually empty. A work or school Mac shows your organization’s profile, which is expected.
3. Remove any profile you didn’t add, especially one that mentions a browser, search or proxy.

4. Check browser extensions

Adware usually lives here.

• Safari: Safari > Settings > Extensions.
• Chrome: go to chrome://extensions.
• Firefox: go to about:addons.

Remove any extension you didn’t install. Then check the browser’s home page and default search engine in its settings.

5. Check the startup folders

Some programs start from files that don’t always show clearly in System Settings. Open Terminal and run:

ls -l ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons

Each file is a small .plist that tells macOS to start a program. Names usually start with the developer’s web address written backwards, such as com.google.keystone.agent.plist. Look closer at a file with a random name, a recent date you can’t explain, or one that runs a program from a hidden folder or /tmp.

6. Look at Activity Monitor

1. Open Activity Monitor, in Applications > Utilities.
2. On the CPU tab, click % CPU to sort by it.
3. On the Network tab, click Sent Bytes to sort by it.

Many unfamiliar names, such as cloudd or mds_stores, are parts of macOS. A process you can’t identify that keeps sending data while you aren’t doing anything is worth searching.

If you find something

1. Back up your files with Time Machine before removing anything, if you don’t have a recent backup.
2. Remove the app the item belongs to, then the item itself. Quit the app, move it to the Trash, then turn off its entry in Login Items & Extensions.
3. Change passwords from another device if you found a password stealer or remote-access tool, starting with your Apple Account, email and bank.
4. Restart and check again to make sure the item didn’t come back.

If you’re not sure whether something is malware, leave it until you’ve looked it up. Removing the wrong item can stop an app you use from working.

What these checks can’t tell you

A clean result means nothing suspicious showed up in the places Mac malware usually uses. It doesn’t prove the Mac is clean. Malware written for one person, or too new for anyone to have described, can avoid all six. If you think someone targeted you specifically, get help from a security professional.

Frequently asked questions

Sources

1. Apple Platform Security, Protecting against malware in macOS.
2. Apple Support, Safely open apps on your Mac.
3. Apple Support, Change Login Items & Extensions settings on Mac.
4. Setting names, menus and the Terminal command checked on macOS 26.0.1 (25A362), 31 October 2026.