How to remove malware and viruses from Mac

It has been a long time since we believed that Macs could not get viruses. While Mac computers are more secure than their competitors, they still can get infected. The number of Windows infections often overshadows macOS-specific threats, making users assume that Macs are completely immune. 

But is there a difference between malware and viruses? Malware is an umbrella term for malicious software that performs unauthorized tasks on your device. These can include stealing sensitive information, tracking keystrokes, unauthorized network access, or geolocation. A virus is just one specific type of malware.

Here are some of the latest Mac-specific threats:

Banshee Stealer — Malware-as-a-service that targets macOS users, stealing browser credentials, passwords, and cryptocurrency wallets.

North Korean FlexibleFerret — macOS malware disguised as popular app installers like Zoom and Google Chrome. 

Poseidon (aka Rodrigo) — Another macOS stealer capable of extracting data from crypto wallets and accessing data from password managers.

Knowing how to spot the early signs of a threat and remove malware is essential to keeping your Mac safe. 

Does Apple protect itself enough? 

Apple builds three layers of malware protection into macOS. First, Gatekeeper and notarization stop known malware from opening: Gatekeeper checks that an app you download comes from an identified developer and has been notarized, which means Apple scanned it for known malware. Second, Gatekeeper, notarization, and XProtect, a malware scanner built into macOS, block known malware from running. Third, if malware does run, XProtect can remove it: it checks for infections in the background and removes the malware it recognizes.

While macOS is well-protected, cybercriminals continue to find ways to bypass these security measures.

According to Moonlock's 2025 macOS threat report, entry-level stealer malware for Mac can now be bought online for $1,000 a month, down from $3,000, which makes these threats more accessible and widespread.

Here are some of the most prevalent macOS threats you should be aware of:

• Adware: Unwanted software that displays intrusive ads, tracks browsing activity, and collects sensitive information.
• Stealers: Malware designed to collect and steal sensitive data, such as cookies, passwords, etc.
• Crypto miners: Malware that hijacks system resources (memory, bandwidth) to mine cryptocurrency.
• Potentially unwanted applications (PUAs): Apps that aren't malicious but can display ads, install malware, and collect user data.
• Ransomware: One of the most dangerous threats, ransomware encrypts personal files and demands payment for decryption.
• Phishing: A social engineering attack that tricks users into revealing credentials, financial details, and personal information.

How to spot malware on your Mac

As a rule, aggressive malware comes in all shapes and sizes depending on the end goal it was created to attain. While some bring chaos and disruption, others silently steal information. There are also ones that are simply byproducts of a virus. 

So, when it comes to detecting malware, it's not always that straightforward. Any sudden unusual behavior is the first red flag. Here are the common signs of a malware attack:

• Your Mac becomes very slow for no reason. Crypto miners, spyware, and certain types of adware often run hidden processes that drain CPU resources and may slow down Mac performance.
• You're missing or unable to open files and folders. Missing files or folders that won't open could be a sign of ransomware encrypting your data or malware modifying system permissions.
• Your device repeatedly restarts. Frequent, unexpected restarts can indicate a kernel panic, often caused by faulty software. Some types of malware modify system files, causing instability and crashes that force your Mac to reboot.
• Your search engine homepage is different. If your browser homepage or default search engine has changed, you may have adware. This malware alters system settings, installs malicious extensions, and redirects your searches to display ads and generate revenue.
• Your Wi-Fi connection is unstable. While a poor connection isn't always a sign of malware, some threats can use excessive bandwidth for crypto mining, botnet activity, or data transfer.

Have you found something suspicious? Head to the next section to learn how to get rid of malware on your Mac. 

How to remove viruses and malware from your Mac

Here's how to remove malware from your Mac, step by step. If this is a work Mac, talk to your IT team first: don't remove device management profiles, security agents, or other software your IT team installed.

1. Disconnect from the internet

If you suspect malware, the first step is to disconnect from the internet immediately. Most malware uses the internet connection to transfer data into a hacker's hands. Disconnecting from the internet will immediately stop malware from stealing data, giving you time to spot and remove suspicious software.

Select the Wi-Fi icon from the top menu bar and toggle your Wi-Fi off. 

2. Check your browser

Adware can take over your browser, flooding you with intrusive ads and redirecting your searches. Keep an eye out for suspicious browser extensions and check your homepage and search engine settings to ensure they haven't been altered.

Chrome extensions checkup:

1. Open Chrome and enter chrome://extensions/ in the search bar.

2. Here, you will find all your extensions. Choose those you don't recognize and click Remove to uninstall them.

Safari extensions checkup:

1. Open Safari, select the Safari main menu > Settings > Extensions.

2. All your Safari extensions are listed here. To remove those you don't recognize, click Uninstall.

Firefox extensions checkup:

1. Open Firefox, then click the main Firefox menu > Settings > Extensions & Themes.

2. Your extensions will be listed under Enabled. To remove, select the three dots and click Remove.

Now that you've checked the extensions, it's time to verify the homepage and search engine:

• Chrome: Go to Settings > On startup and then Settings > Search.
• Safari: Open Settings > General and Settings > Search > Search engine. 
• Firefox: Navigate to Settings > Home and startup and Settings > Search.

For each browser, set the homepage and search engine of your preference.

Did you know? Adware known as browser hijackers can change your default search engine without asking. If your searches go through a search engine you didn't choose, switch back to your preferred one as shown above. If you added DuckDuckGo yourself and no longer want it, here's an article on how to remove it from Mac.

3. Scan for malware

One way to find and remove malware is to use the Apple-notarized app — CleanMyMac.

CleanMyMac scans your Mac for malware and neutralizes the threats it finds.

Here's how to spot and neutralize malware on your Mac:

1. Get your free CleanMyMac trial.
2. Open the app. From the sidebar, select Protection.
3. Click Scan. Wait till CleanMyMac checks your whole system. If anything malicious is found, follow the steps on the screen to remove it. Also, review your application permissions to make sure no apps can access your files without you knowing.

Last but not least, I'm a huge fan of CleanMyMac UI/UX design, particularly navigation and menu features. It allows you to get a quick visual overview of your Mac's health and see what fixes have to be done immediately. Simply run a Smart Care scan.

If you're not a fan of third-party applications, no problem. There are plenty of other useful tips below to help you locate and eliminate malware.

4. Check Activity Monitor

1. Open Finder, select Applications > Utilities > Activity Monitor.
2. Now select the CPU tab from the top and look for unrecognized processes.
3. Don't quit an unfamiliar process straight away: many belong to macOS itself, and quitting doesn't remove malware that starts again. Select it, click the Info button, and open the Open Files and Ports tab to see where its file is stored, check who signed it, and look up its name. Act only once you're sure.
   
4. Repeat this process in the Memory tab.

Also, check this article on how to identify malware in Activity Monitor.

5. Locate login malware

Login items are applications that launch when we start our devices. Sometimes, malware like cryptocurrency miners can disguise themselves as a login item and launch each time you reboot your Mac.

Here's how you can check for malicious login items:

1. Go to the main Apple menu > System Settings > General > Login Items & Extensions.
2. To remove an item, select it, then click the "-" button. In the list of apps allowed to run in the background, turn off any you don't recognize.

Malware can also start itself with a launch agent or launch daemon, a small file that tells macOS what to open. Check these folders with Finder > Go > Go to Folder: ~/Library/LaunchAgents, /Library/LaunchAgents, and /Library/LaunchDaemons. Move to the Trash only a file you've linked to the malicious app, for example, one that mentions its name or location, then restart your Mac, because a process that's already running keeps going until you do.

Then check for configuration profiles you didn't install: choose Apple menu > System Settings > General > Device Management. In Chrome, open the menu and look at the bottom for managed by your organization. On your own Mac, either of these can mean adware has taken control of your settings; remove a profile you don't recognize by selecting it and clicking the Remove button. On a work Mac, both are usually set up by your IT team, so leave them alone and ask IT.

6. Check your Downloads folder

Malware often comes bundled with files downloaded from unreliable sources, including .dmg files, which are commonly used to distribute macOS applications. Cybercriminals have exploited this format to spread malware like the Banshee Stealer and AMOS.  If you suspect malware, go to your Downloads folder to review recently downloaded installers (.dmg and .pkg files) and remove the ones you didn't mean to download.

1. Open Finder and select Downloads from the sidebar.

2. Review your files. If anything suspicious is found, select it and move it to the Trash.

Don't forget to empty your Trash afterward.

7. Boot into safe mode

Another way to check for malware is to boot into safe mode — it stops login items and extensions that macOS doesn't need from loading at startup, which can make it easier to find and remove software that starts automatically.

Apple silicon:

1. Shut down your Mac and wait 10 seconds.
2. Press and hold the power button until the startup options window shows up.
3. Select a startup disk.
4. Press the Shift key and click Continue in Safe Mode.
5. Release the Shift key.

Intel:

1. Shut down your Mac and wait 10 seconds.
2. Restart your Mac and press the Shift key.
3. Release the Shift key after the login window shows up.

8. Restore from a backup

If the above tips didn't help, the safest route is to erase your Mac and then restore only your personal files from a Time Machine backup made before the infection. Restoring onto a Mac that's still infected, or from a backup made after the infection, can keep or bring back the malware. On a Mac with Apple silicon or the Apple T2 Security Chip running macOS Monterey or later, choose System Settings > General > Transfer or Reset > Erase All Content and Settings. Then restore your files:

1. Make sure you've connected your external Time Machine backup drive.

2. Go to Finder > Applications > Utilities > Migration Assistant. 

3. Select the "from a Mac, Time Machine backup, or startup disk" option and click Continue.

4. Now, select the Time Machine backup you want to use and click Continue.

5. Select only your personal files to transfer, not apps or system settings: click the disclosure arrow next to a category to pick specific items. Then click Continue to start the transfer. This could take several hours.

Once the transfer is completed, install legit antivirus software if you still don't have one. 

9. Change your passwords if data may have been stolen

Removing malware doesn't undo what it has already taken. Stealers like Banshee, Poseidon, and AMOS go after saved passwords, browser cookies, and crypto wallets, so if you found one, or can't rule it out, treat that data as stolen. Change your important passwords from another device you trust, starting with your email and banking. In each account, sign out of all other sessions and devices, because stolen browser cookies can let someone in without your password or two-factor code. If you keep cryptocurrency on this Mac, move it to a new wallet.

How to prevent Mac from malware infection 

Prevention is the best defense against malware. So, what can we do to prevent infections in the first place? 

1. Keep your Mac updated

Keeping your macOS updated ensures your Mac receives the latest security patches and performance improvements. Check if updates are available:

1. Select the main Apple menu > System Settings > General > Software Update.

2. If you have an update waiting, follow the on-screen instructions to install it.

2. Download software from trusted sources

If you only download software from the Mac App Store, you will probably never encounter malware. But if you have to download software from someplace else, make sure it's a trusted source. Always think before clicking download — avoid suspicious links in emails, pop-up ads, and messages on social media. 

3. Ignore fake technical help

If you ever receive a phone call from a company — Apple or any other well-known service provider — telling you your Mac is infected, hang up. Apple never makes such calls concerning malware.

4. Install antivirus software

While Macs come with XProtect, it works automatically in the background; third-party antivirus software adds features such as scans you run yourself. With Mac threats on the rise, investing in additional protection is a smart choice. Take your time to research and find the software that fits your needs.

5. Never paste commands from a website into Terminal

A common way stealers such as AMOS get onto Macs is a fake instruction: a website, pop-up, or message asks you to copy a command and paste it into Terminal, often dressed up as a fix or a verification step. Moonlock's 2025 report calls this trick ClickFix. Never paste a command you don't understand into Terminal. Be just as careful with unexpected windows that ask for your Mac password: type it only when you've just started an installation or a settings change yourself.

I hope you've found these tips useful and your life is free from Mac malware. Even if you haven't caught one yet, you still shouldn't forget about the prevention techniques described in this article.

The general rule is to get reliable antivirus software and think twice before you click. Stay safe!