How to remove malware from a Mac, step by step

Signs your Mac has malware

• Your browser's home page or search engine changed by itself, or ads and pop-ups appear on sites that didn't have them.
• Apps, browser extensions or a profile you don't remember installing.
• A password prompt that appeared right after you opened a download, or asked for your Mac password for no clear reason.
• Fans running and the Mac hot while idle, with a process in Activity Monitor you don't recognize at the top of the CPU list.
• Logins to your accounts from places you've never been, or crypto that left your wallet.

A scary pop-up in your browser on its own is not a sign of infection; see the Apple Security Alert scam.

1. Disconnect, and don't type any passwords

Turn off Wi-Fi or unplug the cable, so whatever is running can't send more data or download more. Until you are done, don't enter your Mac password, or any other, into a prompt you didn't expect.

2. Quit what is running

Open Activity Monitor and sort by % CPU. For any process you don't recognize, select it and click the Info button (ⓘ); Open Files and Ports shows where its file is. Note the location, then click Stop (✕) and Force Quit. Search the name online first if you aren't sure; many odd names are parts of macOS.

3. Remove apps you didn't install

Open Applications in Finder, sort by Date Added, and drag anything you don't recognize to the Trash, especially apps added around when the trouble started. Malware often uses names that sound useful, such as a cleaner, a video player, a PDF tool or an update for something you already have. To remove an app's leftover files too, see how to uninstall apps completely.

4. Check what starts with your Mac

Malware stays by starting itself at every login. Open System Settings › General › Login Items & Extensions:

• Under Open at Login, remove anything you don't know with the − button.
• Under Allow in the Background, turn off items from developers you don't recognize. Click the Info button (ⓘ) next to an item to see the files behind it.

Then look in the launch folders themselves. In Finder, choose Go › Go to Folder and open each of these: ~/Library/LaunchAgents, /Library/LaunchAgents and /Library/LaunchDaemons. Each file starts one program. Move to the Trash the files with names you don't recognize, or that point to the locations you noted in Activity Monitor, then restart. Leave files from apps you know, such as Google, Microsoft or Adobe.

5. Clean up your browsers

• Safari: in Safari › Settings, remove unknown items under Extensions, and check your home page under General and your search engine under Search. Under Websites › Notifications, deny sites you don't know.
• Chrome, Edge and Brave: remove unknown extensions, then use Reset settings in the browser's settings. If a setting says it is managed by your organization on your own Mac, a profile is forcing it; see the next step.
• Firefox: remove unknown add-ons, or use Refresh Firefox from its troubleshooting page.

6. Remove unknown profiles

Open System Settings › General › Device Management. A profile can set your browser's home page, search engine and proxy, and stop you from changing them back. Unless your workplace or school manages your Mac, select any profile listed there and remove it with the − button.

7. Run a malware scan

XProtect, built into macOS, removes known malware by itself, but it works quietly and you can't run it on demand. A scanner checks the places above in one go and finds what you missed. Tidy My Mac's Antivirus and Adware scans do this, and Malwarebytes has a free scanner for Mac that removes what it finds. Run a full scan, quarantine what it reports, and restart.

8. If a password stealer ran

If you entered your Mac password into an unexpected prompt, or pasted a command into Terminal from a web page, assume a stealer copied your saved browser passwords, cookies, keychain and crypto wallets. Removing it doesn't undo that. From another device:

1. Change your email password first, then your Apple Account, banking and everything else saved in your browser, and sign out of other sessions where the site lets you.
2. Turn on two-factor authentication everywhere you can.
3. Move crypto to a new wallet with a new recovery phrase. The old one should be treated as known.
4. Tell your bank if card details were saved in the browser.

When to erase the Mac instead

If the problem keeps coming back, or someone had remote access to your Mac, erasing it is the only way to be sure. Back up your documents, photos and other files, but not your apps or old backups, which may carry the malware back. Then choose System Settings › General › Transfer or Reset › Erase All Content and Settings, available on Macs with Apple silicon or the T2 chip, and reinstall your apps from the App Store or their developers' sites.

Keep it from happening again

Most Mac malware arrives through fake downloads, pirated apps and commands pasted into Terminal. See do Macs need antivirus for how macOS protects you, and the habits that matter most.

Remove malware with Tidy My Mac

• Antivirus scans your apps, downloads and launch agents with Quick, Normal and Deep scans, and moves what it finds into a quarantine you can review.
• Adware finds browser extensions, profiles, policies and proxies that hijack your browser, and removes them.
• Startup Items and Background Services list everything that starts with your Mac, with the app it belongs to, and Uninstaller removes an app with its helpers.