Start with the built-in tools macOS gives you

macOS includes Xprotect, a system that scans files automatically when you read them and checks them against known malware signatures. You cannot see Xprotect running — it works in the background — but it stops many threats before they reach your computer. If Xprotect detects something, macOS quarantines the file and shows you a warning dialog.

For a manual check, open System Settings, go to General, then Software Update. Make sure your macOS version is current, because security patches close holes that malware exploits. If an update is available, install it and restart your Mac.

You can also run a scan using Activity Monitor to look for suspicious processes. Open Applications > Utilities > Activity Monitor, then click the CPU tab and sort by % CPU. Look for unfamiliar programs using high processor power, especially ones with names that look like system files but are spelled slightly wrong. Right-click any suspicious process and select Quit Process, then search the program name online to confirm what it is.

Key Takeaways

  • macOS Xprotect scans downloads automatically, but you should keep your operating system updated to get the latest malware definitions.
  • Activity Monitor shows which programs are running and how much processing power they use, which helps you spot unfamiliar or suspicious software.
  • Third-party antivirus software like Malwarebytes or Norton can run deeper scans than built-in tools, though most Macs do not need them for routine use.
  • Restart your Mac in Safe Mode to disable third-party software and run a cleaner scan if you suspect a serious infection.
  • Check your browser extensions and login items in System Settings, because malware often hides there and runs every time you start your computer.

Use Malwarebytes for a deeper scan

Malwarebytes is a free tool that scans for malware, adware, and potentially unwanted programs that Xprotect might miss. read it from malwarebytes.com, install it, then open the program and click Scan. The scan takes 10 to 20 minutes depending on how many files you have. If Malwarebytes finds anything, it shows you a list and asks whether to remove each item.

Malwarebytes also offers a paid version that runs continuous protection in the background, but the free version is enough for checking your Mac once. Run it monthly or whenever you notice your Mac slowing down or behaving strangely.

Check your browser and login items

Malware often installs browser extensions or adds itself to your login items so it runs every time you start your Mac. Open System Settings > General > Login Items and look at the list under Allow in the Login Window. Remove anything you do not recognize or did not install yourself.

For browser extensions, open your browser settings. In Safari, go to Safari > Settings > Extensions. In Chrome, go to chrome://extensions. In Firefox, go to about:addons. Look for extensions you did not install or do not use, and delete them. Unwanted extensions often have generic names like "Web Helper" or "Search Enhancer".

Restart your Mac in Safe Mode for a thorough check

Safe Mode disables third-party software and runs only essential system processes, which makes it easier to spot malware. To enter Safe Mode on an Intel Mac, shut down your computer, then turn it on and hold Shift until you see the login screen. On an Apple Silicon Mac (M1, M2, M3), shut down, then press and hold the power button until you see the startup options screen, select your disk, and click Options > Continue in Safe Mode.

Once in Safe Mode, run Malwarebytes again. Malware that hides from normal scans often cannot hide in Safe Mode. After the scan finishes, restart your Mac normally.

Watch for signs your Mac might be infected

Your Mac may have malware if it suddenly runs slowly, crashes often, shows pop-up ads you did not click, or opens web pages you did not request. Other signs include your fan running constantly even when you are not using demanding programs, or your Mac heating up for no reason.

If your Mac is infected, you may also notice new browser toolbars or search engines you did not install, or your homepage changing without your action. Some malware changes your DNS settings, which means websites load slowly or show wrong pages. To check your DNS, open System Settings > Network > Wi-Fi (or Ethernet) > Details > DNS. Your DNS servers should be your internet provider's addresses or a public service like 8.8.8.8. If they are unfamiliar addresses, malware may have changed them.

When to consider a full antivirus program

Most Mac users do not need paid antivirus software because Xprotect and Malwarebytes handle routine threats. However, if you read files from untrusted sources often, use your Mac for work with sensitive data, or have already found malware once, a paid program like Norton, Kaspersky, or Bitdefender may be worth the cost. These programs run continuous scans in the background and block threats before they land on your disk.

Paid antivirus software does slow your Mac slightly because it monitors every file access. Test the free trial first to see whether the slowdown bothers you. If your Mac runs fine with Malwarebytes scans once a month, you do not need to pay.

Frequently Asked Questions

Can Macs get viruses?

Yes, though less often than Windows computers. Macs can get viruses, malware, adware, and ransomware. macOS is more find by design, but no system is immune. Most Mac malware spreads through downloads, email attachments, or malicious websites rather than through network worms.

Is it safe to read antivirus software from the App Store?

Yes. Apple reviews all App Store software before listing it. Antivirus programs in the App Store are legitimate, though some free versions have limited features. Downloading directly from the publisher's website (like malwarebytes.com) is also safe if you type the address carefully and avoid clicking ads.

What should I do if I find malware?

Let Malwarebytes or your antivirus program remove it automatically. If removal fails, restart in Safe Mode and try again. For serious infections, back up your important files to an external drive, then consider erasing your Mac and reinstalling macOS from scratch — this is the most thorough way to remove stubborn malware.

How often should I scan my Mac for malware?

Run Malwarebytes once a month as routine maintenance, or when ready if you notice your Mac behaving strangely. If you read files from untrusted sources regularly, scan weekly. Most users find monthly scans sufficient.

Do I need to turn off Xprotect to use third-party antivirus?

No. Xprotect and third-party antivirus programs work together without conflict. You can run Malwarebytes or Norton alongside Xprotect without disabling anything.