How to scan and remove malware from Mac: Manual and automatic methods

You can scan your Mac for malware manually by checking Activity Monitor and then removing suspicious items from Login Items & Extensions, the Library folder, and web browsers. Alternatively, use a trustworthy malware removal tool, like CleanMyMac or Moonlock, to run a security check and get rid of malware automatically.

Here's a quick overview of the main methods for detecting and removing malware from your Mac. I'll explain each approach in detail below:

Method	Works best for	Time needed	Difficulty
CleanMyMac scan (from Setapp, 7-day free)	Complete malware removal	2-5 minutes	Easy
Moonlock protection (from Setapp, 7-day free)	Real-time threat monitoring	5-10 minutes setup	Easy
Activity Monitor check	Spotting suspicious processes	5-10 minutes	Moderate
Safe mode boot	Isolating malware issues	10-15 minutes	Moderate
Manual file removal	Advanced users	30+ minutes	Advanced

Or get CleanMyMac as a standalone app on Setapp Marketplace.

Signs of malware on your Mac

Malware can be tricky to spot, especially the fileless variants. I've learned to watch for these warning signs that suggest a possible infection:

• Slow Mac performance or persistent overheating
• Your browser homepage suddenly changes
• Pop-ups and intrusive ads everywhere
• Apps freezing and restarting frequently
• Files or drives you can't open
• Unexpected browser redirects to unfamiliar sites

If you notice more than one of these at the same time, don't wait — run a malware scan straight away.

How to scan your Mac for malware with built-in tools

macOS already has a lightweight scanner called XProtect, and you can run extra checks yourself through Activity Monitor.

Macs come equipped with built-in protective tools like XProtect and Gatekeeper. Apple maintains a database of virus signatures that XProtect uses to detect malicious programs. As XProtect runs automatically in the background, it's passive. It can't scan your Mac on demand if you notice something suspicious.

If you want to manually check for suspicious activity, use Activity Monitor:

1. Go to Finder > Utilities > Activity Monitor.
2. Click the CPU tab.
3. Sort %CPU from high to low and check the processes.

Activity Monitor helps when you know what process to look for. But it won't remove malware for you.

Or buy Moonlock standalone from $13.50 USD/mo + tax.

The easiest way to scan for and remove malware on Mac

I've found that using a reliable tool saves time and catches threats you might miss manually. I’ve been using CleanMyMac to monitor my Mac’s health and clean up junk. Its standout security feature is malware detection powered by Moonlock Engine.

Here's how to remove malware using CleanMyMac:

1. Install and open CleanMyMac.
2. Click Protection from the side panel.
3. Click Scan.

Within seconds, CleanMyMac shows you a list of potentially dangerous items and offers to remove any or all of them. As CleanMyMac's malware database is constantly updated, it stays ahead of most threats.

If you're not sure which security tool to trust, check out this roundup of the best Mac antivirus software to find the right fit.

Remove malware from login items

Login items are programs that launch automatically when you start your Mac. Most are useful background apps. Some might be malware.

Here's how to check and remove suspicious login items:

1. Go to the Apple menu > System Settings.
2. Click General > Login Items & Extensions.
3. Check the list and click the minus (–) button to remove suspicious items.

Some login items like LaunchAgents (background processes that run for your user account) and LaunchDaemons (system-wide background processes that run at startup, before any user logs in) won't appear on this list. You'll need to dig deeper to find them.

For a complete view including agents and daemons, I use CleanMyMac's Login Items tool. It shows all login items in one panel. From there, I can quickly disable or remove any of them.

Check launch agents and daemons manually

Agents and daemons are hidden login items that won't show in the standard list. Both run at startup, but agents work within apps while daemons run system-wide. They operate deep in your system, which is a perfect hiding spot for malware.

Here's how to check LaunchDaemons and LaunchAgents:

1. Open Finder > Go > Go to Folder.
2. Type /System/Library/LaunchDaemons for native macOS processes.
3. Type /Library/LaunchDaemons for third-party apps.
4. Type /Library/LaunchAgents for all user accounts.
5. Type ~/Library/LaunchAgents for your user account.
6. Type /System/Library/LaunchAgents for macOS only.

Look for files with suspicious names or recent modification dates. If you're unsure about a file, search its name online before deleting it.

Uninstall unknown apps

Checking your Applications folder regularly helps spot suspicious additions. It also keeps your Mac clean and fast. To uninstall unknown apps, drag them to the Trash and empty it.

Keep in mind that dragging an app to Trash won't remove its hidden files. Those leftover files could contain malware. To remove them completely, use CleanMyMac's Uninstaller module:

1. Install and open CleanMyMac.
2. Click Applications from the side panel > Scan.
3. Click Manage My Applications.
4. In the Uninstaller tab, select the apps you want to remove completely.
5. Click Uninstall.

CleanMyMac also has a Leftovers feature that finds and removes hidden files left behind by deleted apps.

Remove malware from browser extensions

Browser extensions let you customize your browsing experience — blocking ads, managing cookies, and more. But because they run constantly in the background, they've become a common hiding spot for malware.

Here's how to remove malware from your Mac via browser extensions:

• Chrome: Open Chrome and go to Window > Extensions. Disable and remove suspicious extensions.
• Safari: Open Safari, in the menu click Safari > Settings. Choose the Extensions tab and click Uninstall next to suspicious ones.
• Firefox: Click the three horizontal lines and choose Add-ons and themes. Click Extensions and remove suspicious ones.

Check your extensions regularly and remove any you don't recognize or use.

Secure your internet connection

A VPN protects your online activities by masking your IP address and encrypting your data. Using a VPN helps you access geo-restricted content and protect your connection from cyberattacks.

For this, I use Moonlock as it includes built-in VPN protection that hides your IP address. It replaces your real address with one from a secure server elsewhere. What I also find really useful it you can also block connections from specific countries known for hacking activity.

Two-factor authentication adds another security layer. Set it up for all your important accounts to prevent unauthorized access even if someone gets your password.

For situations where you suspect a more serious or targeted attack, Apple also offers Lockdown Mode on Mac, an extreme protection setting worth knowing about.

Boot your Mac in safe mode to isolate malware issues

Safe mode starts your Mac with only essential programs running. If malware loads automatically at startup, safe mode prevents it from loading. This makes the malware easier to identify and remove.

Here's how to start your Mac in safe mode:

• For Macs with Apple silicon: Shut down your Mac > Press and hold the power button until you see “Loading startup options” > Choose a volume > Press and hold Shift > Click Continue in Safe mode.
• For Intel-based Mac: Restart your Mac > Immediately press and hold Shift until the login window appears > Log in to your Mac.

If your Mac runs normally in safe mode, the problem likely comes from software that loads at startup.

How to protect your Mac from malware

Protecting your Mac from malware comes down to a few habits. Scan regularly, keep macOS updated, and be careful what you download. Use a VPN for browsing. A tool like CleanMyMac can handle most of this automatically.

According to Apple's security documentation, your first line of defense includes:

• Download apps only from the Mac App Store or identified developers
• Let Gatekeeper verify new apps before opening them
• Keep your macOS and all apps updated
• Use strong, unique passwords for each account
• Enable FileVault disk encryption

If you keep noticing malware symptoms even after cleaning up, some security settings might not be configured properly. For example, Gatekeeper might be disabled. Moonlock checks your Mac's security settings and guides you through enabling the right protections.

What is malware?

Malware is any malicious program designed to infect your device and expose your private data to cybercriminals. The term covers all malicious software, regardless of how it works. Don't confuse it with a virus, which is just one specific type that self-replicates by inserting code into other programs.

Common malware types include worms, trojans, ransomware, and spyware. Cybercriminals use these for everything from monitoring keystrokes to hijacking your processing power for cryptocurrency mining. Some malware collects data quietly. Others manipulate network access or hold your files hostage.

Fileless malware has become increasingly common. Unlike traditional malware, it doesn't download files to your system. Instead, it exploits vulnerabilities in existing programs. This makes it harder to detect with standard antivirus scans.

Get rid of malware for good

Malware on a Mac is stressful, but it's fixable. Whether you caught it early through Activity Monitor or needed a full cleanup of login items and browser extensions, you now have the tools to handle it.

For ongoing protection, I keep both CleanMyMac and Moonlock running on my Mac. CleanMyMac handles the heavy lifting, like scanning, removing, and cleaning up leftovers. Moonlock adds real-time monitoring and VPN protection, so threats don't get a foothold in the first place.

Both apps are available on Setapp — a single subscription that gives you access to 270+ top-rated macOS and iOS apps for $14.99 USD/mo + tax. Start your free 7-day trial now. 

FAQ

How can I tell if my Mac has malware?

Watch for these warning signs: Your Mac runs slowly or overheats constantly, your browser homepage changes without permission, pop-ups appear frequently, apps crash repeatedly, or you see unexpected browser redirects. If you notice multiple symptoms, run a malware scan immediately with CleanMyMac.

Is there a way to scan for malware on Mac?

Yes. Your Mac includes XProtect, which scans files automatically in the background. For on-demand scanning, use Activity Monitor to check running processes or install CleanMyMac for comprehensive malware detection. CleanMyMac scans your entire system and removes threats with one click.

Does macOS automatically remove malware?

macOS includes XProtect and XProtect Remediator, which work silently in the background. XProtect blocks known malware from running, while XProtect Remediator removes certain infections on system restarts. However, they only handle threats Apple knows about. For complete protection, use dedicated security software.

Does my Mac have a built-in malware scanner?

Yes, your Mac has XProtect and Gatekeeper built in. XProtect scans files when you open them, while Gatekeeper verifies downloaded apps. These tools run automatically but can't perform on-demand full system scans. They also update less frequently than dedicated security apps.

Can I remove malware manually from my Mac?

You can remove malware manually by checking Activity Monitor for suspicious processes, removing unknown login items, deleting suspicious browser extensions, and clearing launch agents. However, manual removal takes time and might miss hidden components. Tools like CleanMyMac find and remove all traces automatically.