Macs are not immune, and the people who say otherwise are working from a decade-old reputation. What is true is that macOS has three layers of built-in defence, and that the malware which does succeed almost always gets in with the user’s help — a cracked app, a fake installer, or a command pasted into Terminal.
What macOS already does
- Gatekeeper and notarisation check that an app has been signed by a known developer and scanned by Apple before it is allowed to open.
- XProtect scans apps when they first launch, when they change, and whenever its signatures update — which Apple pushes separately from system updates.
- A background remediator removes infections it recognises without asking.
Those layers are why most Mac users never see malware. They are also why the current generation of attacks tries to talk you past them.
How to check your Mac
- Login Items and Extensions. Open System Settings, then General, then Login Items & Extensions. Anything you do not recognise starting at boot deserves a search before you leave it there.
- Activity Monitor. In Applications, Utilities. Sort by CPU and by Network. Look for processes with odd names using resources while you are doing nothing.
- Browser extensions. Check each browser’s extension list and remove anything you did not deliberately install. Hijacked search results and injected ads almost always come from here.
- Profiles. In System Settings, search for Profiles. A configuration profile you did not install — common with adware — can control DNS and proxy settings.
- Applications folder. Sort by date added and look at anything recent you cannot account for.
- Security settings. In System Settings, Privacy & Security, confirm that app downloads are restricted to the App Store or identified developers.
The attacks worth knowing about
Two patterns dominate current Mac malware, and both need you to act.
Information stealers such as Atomic Stealer and its variants arrive in trojanised disk images, cracked applications, and fake job-interview or software-update prompts. They collect browser passwords, cookies, cryptocurrency wallets and keychain contents in one pass. A version discovered in mid-2025 added a backdoor for ongoing access.
ClickFix attacks show a fake error or verification page that asks you to copy a line of text and paste it into Terminal. That command is the infection. No legitimate website will ever ask you to run a Terminal command to prove you are human or to fix a video — recent macOS versions warn about pasted Terminal commands for exactly this reason.
If something is wrong
- Disconnect from the internet to stop data leaving.
- Quit suspicious processes in Activity Monitor, then remove the associated app, login item and profile.
- Scan with a reputable security product. Independent laboratory testing in 2026 gives near-perfect detection scores to several vendors, and free scanners from the main names will do for a one-off check.
- Change passwords from a different, clean device — browser-stored passwords are the first thing stealers take. Our password checker shows which of yours have appeared in breaches.
- Turn on two-factor authentication everywhere, starting with email and anything financial. The authenticator app guide covers how.
- Report it to the NCSC on 0800 114 115 if money or work data is involved.
Do you need antivirus on a Mac?
For a careful user who installs only from the App Store and identified developers, the built-in protections do most of the work. A third-party product adds value if the Mac is shared with children, used for work with sensitive data, or if anyone in the house downloads software from wherever search results lead. Our antivirus comparison for New Zealand covers what current testing shows, and the malware explainer goes through the categories in plainer terms.
The strongest habit costs nothing: keep automatic updates on, install software from the developer or the App Store rather than from a search advertisement, and never paste a command you did not write into Terminal.
Disclaimer
General information only. If a work device is affected, follow your organisation’s incident process first — disconnecting and reporting matters more than cleaning it yourself.
Reference sources
Frequently asked questions
How do I know if my Mac has malware?
Check Login Items & Extensions, Activity Monitor, browser extensions and configuration profiles for anything you did not install. Sudden fan noise, changed search results, injected ads and unexplained network traffic are the common symptoms.
Can Macs get viruses?
Yes. Information stealers targeting macOS are actively distributed through cracked apps, fake updates and fake job interviews. Built-in protections catch a lot, but not what you approve yourself.
Does Apple include antivirus?
macOS has Gatekeeper, notarisation and XProtect, which scans apps at launch and removes recognised infections. It is not branded as antivirus, but it functions as one.
What is a ClickFix attack?
A fake error or verification page that asks you to paste a command into Terminal. The command installs the malware. No legitimate site asks for this.
Do I need to buy antivirus for my Mac?
Not necessarily. It helps on shared or work machines, or where software gets downloaded from search results. A careful user on a personal Mac is well covered by the built-in layers.
How do I remove malware from a Mac?
Disconnect from the internet, quit the process in Activity Monitor, remove the app, login item and any unknown configuration profile, scan with a reputable product, then change your passwords from a clean device.
