Most “my Mac has a virus” reports are a browser notification, not an infection. The rest are usually adware installed alongside something else. A real check is quick, and it is worth knowing what you are looking for before you install anything.

What macOS Already Does

XProtect scans apps at launch against a signature list Apple updates in the background. Gatekeeper refuses to launch unsigned apps from the internet. Notarisation means most distributed apps were scanned at upload.

These are real protections and they run without configuration. They are also all signature-based and all point-in-time, which is why they are not the whole answer.

The Four Places to Look

Launch agents and daemons. Persistence is the defining behaviour of unwanted software — it has to start again after a reboot. Check the non-Apple entries:

launchctl list | grep -v com.apple

Browser extensions. An extension with permission to read and change data on all sites is the most capable software most people install. Review the extension list in each browser you use, and remove anything you do not recognise.

Login items. System Settings → General → Login Items & Extensions shows apps that start at login. Our guide to managing login items covers the hidden half of that list.

Configuration profiles. A profile can redirect traffic or restrict settings, and it is invisible unless you look:

profiles list

On a personal Mac, an unexpected profile is a serious finding.

The Tools That Do This Properly

KnockKnock enumerates everything persistently installed — launch agents, kernel extensions, browser extensions, login items — and checks each against known-good signatures. It is the fastest way to see the whole surface at once.

BlockBlock watches for new persistence being installed and alerts you at the moment it happens, which catches things that were not there on your last scan.

Malwarebytes scans the disk for known unwanted software and removes what it finds. It is the right tool when you suspect something specific rather than wanting a general audit.

LuLu is a firewall for outgoing connections: it asks before an app talks to the network, which surfaces software that has no business phoning home. Our guide to Mac security audit tools covers the wider set.

If You Find Something

Removing the app is half the job; removing its persistence is the other half. An uninstaller that finds leftover files is better than dragging to the Trash — our guide to uninstalling apps completely covers where the leftovers live.

If the finding was a configuration profile, remove it in System Settings before anything else — it can reinstall what you just deleted.

The Honest Baseline

Mac malware exists, is much rarer than on Windows, and almost always arrives because the user installed it: a cracked app, a “codec” from a video site, a browser extension that promised something free. The defence that works is scepticism about what you install, not a scanner running permanently in the background.

Frequently Asked Questions

Does macOS need antivirus software?

macOS ships with XProtect, which checks apps against known malware signatures, and Gatekeeper, which controls what can launch. Both are automatic. A third-party scanner adds value when you want to check an existing disk or verify something you installed, not as permanent real-time protection.

How do I know if a pop-up is a virus warning or real?

Real macOS security warnings come from the system and never ask you to call a phone number. A notification inside a browser window, especially one with a support number, is a web page pretending to be an alert. Quit the browser rather than clicking anything in it.