How to identify malware in Activity Monitor

To check for malware in Activity Monitor, open it from Applications > Utilities, select the CPU tab, and look for processes you don't recognize that use a lot of CPU. Many unfamiliar names belong to macOS itself, so before you quit anything, look the process up, check where its file is stored, and check who signed it.

Malware has many different purposes, and they range in their intent. Some are just annoying, causing continuous pop-ups or messages on your Mac, while others are more sophisticated and aim to control your device and steal personal information like financial information.

Can Macs get malware?

For many years, rumors circulated that MacBooks were immune to malware threats. This false narrative is still in circulation today and causes many new Mac users to have a slack approach to antivirus. Macs can get malware, too.

Malware is considered viruses, Trojan horses, worms, and other programs that can cause damage to your MacBook or privacy. It is often accidentally installed when you download items to your device from emails, websites, suspicious messages, and untrusted sources.

In the section below, we'll talk about what signs to look out for and how you can use Activity Monitor to identify malware.

Identify malware in Activity Monitor

Here is a quick look at some of the most common tell-tale signs your Mac is infected with malware:

• Your Mac starts to operate slowly.

• Your browser has new extensions you didn't install.

• Your browser homepage has changed.

• Random security alerts on your Mac.

• Your contacts receive spam emails or messages from your accounts.

If any or more than one of these signs sounds familiar, first disconnect your Mac from the internet: turn off Wi-Fi or unplug the network cable. This stops the malware from sending more of your personal information to whoever controls it. Then use Apple's built-in Activity Monitor tool to try and confirm your suspicion; here's how:

1. Open Finder > Applications > Utilities > Activity Monitor.

2. Select the CPU tab and look carefully through the list of active apps, programs, and processes.

3. If you see something you don't recognize, especially if it uses a lot of CPU, don't quit it straight away. Many processes with unfamiliar names, such as WindowServer or launchd, belong to macOS itself. Check it first: select the process, click the Info button, then open the Open Files and Ports tab and note where its program file is stored. Look up the process name on another device, such as your phone, and check who signed the file (see below).

4. To stop a process you've confirmed is suspicious, select it, click the Stop button (X) at the top of the window, and choose Quit. Use Force Quit only if Quit doesn't work: it can lose unsaved data. Quitting only stops the process for now, so remove the malware with one of the methods below.
   
   

To check who signed a file, open Terminal from Applications > Utilities, type codesign --display --verbose=4 followed by a space and the location you noted, then press Return. Look at the lines that start with Authority. macOS's own files show an Apple signature, such as macOS Software Signing, and apps from the App Store show Apple Mac OS Application Signing. Other apps usually show Developer ID Application followed by the developer's name. If you don't recognize the developer, or there are no Authority lines at all, treat the process as suspicious.

Now that you've identified malware in Activity Monitor, it's time to remove it. Jump to the next step.

How to remove malware from Mac 

1. Use a third-party malware removal tool

Apple's built-in XProtect detects and blocks known malware, checks for infections in the background, and removes the malware it recognizes. When you find something suspicious on your machine, though, you'll want to check it yourself and get rid of it fast.

The Apple notarized macOS maintenance tool CleanMyMac has a Protection feature, powered by the Moonlock engine, that scans for malware and neutralizes the threats it finds. Here's how to utilize it and restore harmony on your Mac:

1. Open CleanMyMac. No app yet? Get your free CleanMyMac trial — all features are free for 7 days.
2. From the sidebar, select Protection and click Scan.
3. Wait for the scan to complete, and follow the steps you see on the screen.

2. Manually remove malware

If you'd rather not use a third-party tool, then you'll need to take steps to manually remove the threat; here's how:

• Find the file the suspicious process runs from: in Finder, choose Go > Go to Folder, enter the location you noted in Activity Monitor's Open Files and Ports tab, and press Return. If the file is inside an app, that app is what you need to remove.
• If the checks above point to malware, quit the process and move that app, or the file itself, to the Trash. Don't delete other files just because they share its name: legitimate files, including macOS's own, can have similar names, and malware often uses random ones.
• Empty your Trash.

Malware can also set itself to start again after a restart using a launch agent or launch daemon, a small file that tells macOS what to open. Check these folders with Go > Go to Folder:

• ~/Library/LaunchAgents
• /Library/LaunchAgents
• /Library/LaunchDaemons

Move to the Trash only a file you've linked to the malicious app, for example, one that mentions its name or location, then restart your Mac because a process that's already running keeps going until you do.

Although this method will help, application digital leftovers are scattered across our devices; they're sadly not housed in one place. So, you'll need to invest a bit more time to ensure you fully uninstall any apps correctly. Read this complete application removal guide.

3. Use Time Machine

Another option, provided that you use Time Machine for daily backups, is to restore your files from a backup made before the malware arrived. Migration Assistant copies files onto your Mac as it is now, so it doesn't remove malware that's already there, and a backup made after the infection can bring the malware back. If you're not sure the threat is gone, erase your Mac first: on a Mac with Apple silicon or the Apple T2 Security Chip running macOS Monterey or later, choose System Settings > General > Transfer or Reset > Erase All Content and Settings.

Then, restore your files from the backup. Here's how:

1. With your Time Machine external drive connected, open Migration Assistant from the Utilities folder in Applications. 
2. Select Continue and enter your password.
3. Select the From Mac, Time Machine backup, or Startup disk option > Continue. Now, Select your Time Machine backup > Continue.
4. Select the exact backup you want to restore from > Continue.
5. Select only your personal files to transfer, not apps or system settings: click the disclosure arrow next to a category to pick specific items. Then click Continue, and reinstall your apps from the App Store or their developers' websites.

Don't be alarmed if the process takes a while — if you have lots of data, restoring your Mac from a backup can take a few hours.

4. Check your login items for malware

Malware can try to sneak inside your Mac bootup process. Luckily, this is easy to remove; here's how:

1. Select the main Apple menu > System Settings > General > Login Items & Extensions.

2. If something suspicious is in the login list, highlight it and then click the "-" button to remove it. In the list of apps allowed to run in the background, turn off any you don't recognize.

3. Restart your Mac.

Also check for configuration profiles you didn't install: choose Apple menu > System Settings > General > Device Management. Some adware and malware install a profile to control settings on your Mac. If you find one you don't recognize on your own Mac, select it and click the Remove button. On a work or school Mac, leave profiles alone and ask your IT team first.

What to do if your passwords may have been stolen

Removing malware doesn't undo what it has already taken. If you can't rule out that it stole data, such as saved passwords or browser data, change your important passwords from another device you trust, starting with your email and banking. In each account, sign out of all other sessions and devices: stolen browser cookies can let someone in without your password or two-factor code. If you keep cryptocurrency on this Mac, move it to a new wallet.

Protect your Mac

There's no better protection than preventative action. If you haven't already, this is your friendly reminder to invest in some third-party dedicated antivirus software.

You can also help to keep your Mac safe by:

• Keeping your macOS updated

• Downloading apps from trusted sources like the App Store

• Avoiding clicking on suspicious links in emails from unknown senders

• Only using trusted and safe websites

• Regularly removing your stored browser cache

Hopefully, these tips will help you gain back control of your data and your MacBook. Now you know what signs to look for when it comes to recognizing malware threats, how to identify Malware in Activity Monitor, and, just as importantly, how to remove it.