Ransomware protection for Mac: stop encryption while it starts

What ransomware does on a Mac

Ransomware doesn't need to break macOS. It runs as you, with the access you already have to your own files, and that is all it needs. It opens your documents one after another, writes an encrypted copy over each one, often renames it (report.docx becomes report.docx.locked), and leaves a note in every folder, named something like HOW_TO_DECRYPT.txt, with the ransom demand.

A new ransomware program has no signature yet, so an antivirus that compares files with known malware can miss it on day one. What every ransomware program has in common is what it does to your files. That is what Ransomware Protection watches for.

How Tidy My Mac spots ransomware

No single changed file proves anything: you rename files, apps save, and backups write all the time. Ransomware Protection looks for three signs, and acts when many of them land in a few seconds.

One renamed file is a curiosity. A dozen files showing these signs within ten seconds is a program working through a folder, and that is when the guard steps in.

It also places a few hidden decoy files among your documents. Nothing you use opens them, so a program that rewrites one is almost certainly ransomware, and the guard acts on that alone.

Finding the program, and stopping it

macOS tells an app which files changed, but not who changed them. So when the alarm goes off, Tidy My Mac looks at the programs running at that moment: how much each one is writing to disk, which files in your folders it has open, and which decoy it touched. The one doing the writing is stopped, together with copies of itself it started alongside.

Some programs are never stopped, because a Mac without them is broken: Finder, Spotlight, iCloud, Time Machine and the rest of macOS's own code. Command-line shells and tools like openssl are Apple's too, but ransomware scripts run on them, so they get no free pass.

A notification tells you what happened: which program was stopped, and which files it changed. If it was something you trust, such as an encryption, sync or photo-processing tool rewriting many files on purpose, choose Always Allow. An allowed program is remembered by its developer's signature and its location, so its updates stay allowed but a different program dropped in the same place doesn't. Unsigned programs are remembered by a fingerprint of their code, which changes with any edit.

Works with the antivirus

The Antivirus and Ransomware Protection catch different things. The antivirus scans what you download and recognises known malware before it runs. Ransomware Protection watches behaviour, so it can catch a program nobody has seen yet, after it starts. Together they cover the moment before you open something and the moment after.

What stays on your Mac

Everything Ransomware Protection does happens on your Mac: watching your files, reading which programs are writing, stopping one. Nothing about your files or your programs is sent to us. The Privacy Policy lists every request the app makes.

Full Disk Access

macOS protects Desktop, Documents and Downloads with a permission of their own. Ransomware Protection needs Full Disk Access to watch them, the same single grant the rest of Tidy My Mac asks for at first launch.