How to scan a Mac for malware and remove it
You can scan a Mac for malware largely with tools Apple already builds into macOS. This guide covers the warning signs, the built-in checks and the cleanup steps, plus where Hide Expert VPN fits into everyday Mac protection.
Signs your Mac may have malware
Malware on a Mac rarely announces itself, but it often leaves traces:
- the Mac becomes slow, or the fans run hard while you are doing very little;
- your browser homepage or search engine changes without your action;
- pop-ups, intrusive ads and redirects appear on sites that used to be clean;
- the Mac restarts on its own, or apps crash more often than usual;
- you find apps, browser extensions or login items you never installed.
None of these proves an infection on its own, but two or more together are worth a closer look.
How macOS protects you automatically
Every Mac includes XProtect, Apple's built-in malware detection. It relies on signatures of known malware that Apple updates automatically, checks apps against them, and works by default without any setup. When it recognizes a known threat, macOS warns you and offers to move the item to the Trash.
Gatekeeper adds another layer: it checks that apps downloaded outside the App Store come from identified developers and have been notarized by Apple. To keep both up to date, open System Settings, go to General, then Software Update, and make sure automatic updates are on, including the option that installs security responses and system files. Updates matter because attackers often exploit known flaws, as the regular Apple patches for actively exploited issues show.
How to scan a Mac for malware manually
Built-in protection mainly catches threats Apple already knows about, so a manual check helps with newer or unusual malware.
Check Activity Monitor
- Open Activity Monitor from Applications > Utilities.
- In the CPU tab, click the % CPU column to sort processes from highest to lowest.
- Look for unfamiliar names that use a lot of resources, then check the Memory and Network tabs as well.
- Before quitting or deleting anything, look up the exact process name from a trusted source – many legitimate system processes have unusual names.
Review your applications
Open the Applications folder in Finder and sort by date added. Anything you do not remember installing deserves a quick check. To remove an app, drag it to the Trash and then empty the Trash.
Be especially wary of cleaner or antivirus apps you never chose to install. Fake security tools that scare you into paying are a long-running trick, as this fake antivirus scam shows.
Check login items and background items
A lot of malware starts automatically every time you log in. Open System Settings, go to General and open Login Items – the exact name varies slightly between macOS versions, and on older versions it sits under Users & Groups. Remove unfamiliar apps from the list that opens at login, and switch off unknown entries in the section for items allowed to run in the background.
For a deeper look, use Go to Folder in Finder's Go menu to open /Library/LaunchAgents, /Library/LaunchDaemons and ~/Library/LaunchAgents. These folders hold files that start programs automatically, so an unknown file there is a red flag worth researching before you delete it.
Clean up your browsers
In Safari, open Settings, then Extensions, and remove extensions you do not use or recognize. Do the same in any other browser you use, and reset the homepage and default search engine if they changed.
When built-in tools are not enough
If problems continue, start your Mac in Safe Mode, which prevents some software, such as login items, from loading at startup. On a Mac with Apple silicon, shut down, press and hold the power button until startup options appear, select your startup disk, then hold Shift and choose Continue in Safe Mode. On an Intel-based Mac, restart and immediately hold Shift until the login window appears. Stay offline while you clean up.
A reputable third-party scanner can give a second opinion, though traditional antivirus tools have limits of their own. Check who makes any scanner you consider and read its privacy policy before installing.
If malware keeps coming back, back up your personal files, then erase the Mac and reinstall macOS. On recent Macs, Erase All Content and Settings under System Settings > General > Transfer or Reset does this quickly; on others, use macOS Recovery. Copy back only personal documents rather than apps or system settings, and reinstall apps from their official sources.
After the cleanup
Change your passwords from a device you trust, starting with email, banking and your Apple Account. If you entered card or bank details while the Mac was infected, contact your bank. Targeted Backdoors such as the JokerSpy macOS toolkit can collect data from an infected Mac, including this kind of information.
To lower the risk next time, keep automatic updates on, install software only from the App Store or official developer sites, and be careful on public Wi-Fi. On untrusted networks, Hide Expert VPN encrypts your connection, although no VPN replaces regular malware checks.
Conclusion
To scan a Mac for malware, start with XProtect and automatic updates, then check Activity Monitor, your apps, login items and browser extensions. If problems persist, use Safe Mode or erase and reinstall macOS, and change your passwords afterward.