What macOS already does
Apple's security guide describes three layers: Gatekeeper and notarization stop most malware from opening, XProtect blocks known malware when an app first opens, changes on disk or when its signatures update, and a remediation engine checks periodically for infections that got through and removes them. macOS looks for new XProtect signatures daily by default (Apple Platform Security, Protecting against malware in macOS).
When XProtect catches something you see it: a Malware Blocked and Moved to Trash alert naming the file. Apple's advice for anything flagged is to leave it in the Trash and empty it (Apple, What is malware on Mac?).
What macOS doesn't do is scan every file on demand, and it has no setting to start one. What is XProtect? shows how to confirm it's switched on and current, which is the first thing to check. The rest of this guide covers what XProtect may not know about yet, and the adware and unwanted software that sits between "virus" and "app you chose to install".
Signs your Mac may have malware
- Pop-ups that won't go away, even on sites that never had them. Apple says this can mean adware was installed without you meaning to (Apple, Block pop-up ads and windows in Safari).
- Your browser's home page or search engine changed, and changes back after you fix it.
- A browser extension, app or menu bar icon you don't remember installing.
- A "Background Items Added" notification for a developer you don't recognize, right after you installed something you weren't sure about.
- A profile under Device Management on a personal Mac that no school or employer manages.
- Accounts used from places you weren't, or password-reset emails you didn't ask for.
What isn't a sign on its own: a slow Mac, loud fans, or a process with an odd name in Activity Monitor. Most of those names belong to macOS (kernel_task, syspolicyd, mds_stores and many more), and a slow Mac usually has an ordinary cause; Why is my Mac so slow? goes through them.
Pop-ups that say your Mac is infected
A web page that announces a virus, shows a countdown or gives a support number is a scam, not a diagnosis. Apple says pop-ups that warn about security problems or viruses are usually fraudulent ads, and that callers claiming to be Apple can fake caller ID (Apple, Recognize and avoid social engineering schemes). Close the tab. If the page won't let you, press Option-Command-Esc and force quit the browser (how to force quit). Don't call the number, don't download the "cleaner" it offers, and don't give anyone remote access. If the page appeared once and is gone after closing it, nothing was installed.
How to remove malware, step by step
Work through these in order. Each step only removes things you've decided you don't want, and all of them work the same on macOS 15 Sequoia, macOS 26 Tahoe and macOS 27.
- Update macOS. Apple's first step for adware is to install the latest macOS, which also brings XProtect up to date; if you're already current, restart (Apple).
- Quit anything suspicious. If an app you don't recognize is open, quit it, or force quit it in Activity Monitor.
- Check Applications. In Finder, open the Applications folder and sort by Date Added. Move apps you don't expect to the Trash. If an app came with its own uninstaller, use it; how to uninstall apps completely covers the leftovers.
- Check login and background items. Open System Settings › General › Login Items & Extensions. Remove unfamiliar apps under Open at Login, and switch off unfamiliar entries in the background list, called Allow in the Background on macOS 15 and App Background Activity on macOS 26 and 27. Entries can carry a company name rather than an app name; how to stop apps opening on startup explains them.
- Check profiles. Open System Settings › General › Device Management (you may need to scroll). A personal Mac usually has nothing here. To remove a profile you don't recognize, select it and click the Remove button; Apple notes that removing a profile also removes the settings it made (Apple, Use configuration profiles). On a work or school Mac, leave profiles alone and ask IT.
- Check your browsers. In Safari, choose Safari › Settings: uninstall extensions you don't use under Extensions, and check the home page under General and the search engine under Search. In Chrome, open
chrome://extensions, then use Settings › Reset settings if the home page or search engine keeps changing. - Get a second opinion. Run one of the scanners below, then restart and check that nothing you removed has come back.
The launch folders, if something keeps coming back
Persistent adware often installs a launch agent or daemon: a small settings file that tells macOS to start a program at login or startup. They live in three folders, which you can list without changing anything:
ls -l ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemonsEach file is named like com.vendor.thing.plist, usually after the company that installed it. Look for names you can't match to anything you use, and look them up before acting. Files from apps you rely on, such as a VPN, backup software or a printer driver, belong there.
Before you delete a launch file: removing the wrong one stops that app's helper from running, and items in /Library need an administrator password. Move a file to the Trash rather than deleting it outright, so you can put it back, and restart afterwards. Never remove anything from /System; System Integrity Protection guards it anyway. If you'd rather not do this by hand, the free KnockKnock (below) lists the same items with their signatures.
Scanners worth using
A second opinion is reasonable if you saw the signs above or opened something you now regret. Download any of these from the developer's own site, never from an ad or a pop-up. Checked 20 October 2026.
| Tool | What it does | Cost |
|---|---|---|
| Malwarebytes for Mac | Scans on demand and quarantines what it finds; Malwarebytes describes the free version as a clean-up tool for infections already on a device | Free scanner; real-time protection in paid plans, with a 60-day money-back guarantee |
| KnockKnock | Lists everything set to start automatically, with signatures and an optional VirusTotal check; version 4.1.0, macOS 10.15 or later | Free and open source, from the non-profit Objective-See Foundation |
Be wary of scanners that find problems for free and charge to remove them, or that arrive bundled with something else. Is MacKeeper safe? shows how to check a security app's maker before paying. These scanners are a second opinion, not a replacement for keeping macOS updated.
If you typed passwords into something suspicious
Removing the software doesn't undo what it may already have sent. If you entered passwords or card details into a fake page or app, change those passwords from another device, starting with your email and Apple Account, and tell your bank about the card. Apple's steps for an Apple Account you think is compromised include changing the password, removing devices you don't recognize at account.apple.com and turning on two-factor authentication (Apple, If you think your Apple Account has been compromised).
When to erase and start again
If something keeps returning after the steps above, or a scanner finds software built to steal data, the clean answer is to back up your documents (not your apps), erase the Mac and reinstall your apps from their makers. On an Apple silicon Mac, Erase All Content and Settings does that in a few minutes; how to factory reset a MacBook walks through it. Restore files from a backup made before the trouble started, if you have one.
How Tend helps
Tend isn't antivirus: it has no malware engine, doesn't scan your files and can't remove malware. Its free Security check helps with the looking. It shows whether Gatekeeper, FileVault, the firewall and System Integrity Protection are on and which XProtect version you have, lists apps that don't come from a notarized developer or the App Store, and flags startup helpers that point at a missing file, aren't signed by an identified developer, or run from a temporary folder, your Downloads folder or a hidden folder in your Library. Its free Startup Items view switches helpers off, reversibly. How the Security check works.
Questions
Can a Mac get a virus?
Yes. Macs can get malware, including adware and programs that try to steal passwords or data. It arrives through downloads from websites, email and messages, often disguised as something useful. macOS blocks and removes known Mac malware with XProtect, and Gatekeeper stops most unverified apps from opening.
How do I scan my Mac for malware?
macOS has no scan button: XProtect checks apps when they open and removes known infections in the background. For an on-demand scan, use a reputable scanner such as Malwarebytes, downloaded from the vendor's own site, and check Login Items & Extensions, Device Management and your browser extensions yourself.
How do I get rid of a pop-up that says my Mac is infected?
Close the tab or window, and force quit the browser if it won't close. Don't call any number it shows or download what it offers. Apple says pop-ups that warn about viruses are usually fraudulent ads. If pop-ups keep coming back on their own, check for adware with the removal steps in this guide.
Is Malwarebytes free for Mac?
Malwarebytes offers a free version that scans on demand and quarantines what it finds. Real-time protection, which watches for malware all the time, is part of its paid plans. Download it only from malwarebytes.com.
Does Tend remove malware?
No. Tend isn't antivirus and has no malware engine. Its free Security check shows Gatekeeper, FileVault, the firewall and XProtect's version, and lists apps and startup helpers whose signatures or locations stand out, so you know where to look.
Related guides
What is XProtect on Mac, and do you still need antivirus?
What macOS's built-in protection covers
“Apple could not verify” a Mac app: what to do
When to open an unverified app, and when not to
Is MacKeeper safe? What it does and how to remove it
Checking a security app before you pay
How to stop apps from opening on startup on a Mac
Login items and background helpers, explained
More detailed guides:
More detailed guides:
Sources
- Apple Platform Security, Protecting against malware in macOS
- Apple, What is malware on Mac?
- Apple, Block pop-up ads and windows in Safari
- Apple, Recognize and avoid social engineering schemes
- Apple, If you think your Apple Account has been compromised
- Apple, Use configuration profiles: macOS 15, macOS 27
- Apple, Change Login Items & Extensions settings on Mac: macOS 15, macOS 26, macOS 27
- Malwarebytes, Malwarebytes for Mac, checked 20 October 2026
- Objective-See, KnockKnock (version 4.1.0, released 15 September 2026) and About the Objective-See Foundation, checked 20 October 2026
See what starts with your Mac, and how it's signed
Tend is free to download. Pro is $1.99 a month, $12.99 a year with a 7-day free trial, or $29.99 once.