Can Macs Get Viruses? How To Remove Malware From Macs

How Can You Tell If Your Mac Has a Virus?

Yes, your Mac can get viruses. Despite just 7% of all malware targeting Mac computers (versus 91% for Windows PC), Mac computers are not impervious to viruses [*].

As of August 2023, malware researchers have identified nearly one million known malware viruses targeting Apple devices [*]. 

If your Mac has been behaving strangely — if, for instance, it’s suddenly slower or hotter than usual, apps continuously crash, or you’re being bombarded with ads — it may be infected with some kind of malware. 

In this guide, we’ll explain the typical warning signs of a Mac virus, provide step-by-step instructions on how to remove Malware from your Mac, and show you how to protect your computer from cyberattacks.

{{show-toc}}

How To Know If Your Mac Has a Virus: 10 Warning Signs

Most people use the term “virus” to describe the different types of malware that hackers use to take over, gain access to, or remotely steal data from a computer. 

This can include ransomware that locks you out of your Mac until you pay a ransom, adware that causes constant pop-ups to take over your browser, or trojans that hide as legitimate software. 

For years, Macs were widely believed to be invulnerable to viruses and malicious software due to Apple’s use of “sandboxed apps.” Instead of apps having full access to your Apple computer’s data, they only can access the minimum amount of data required to run properly. This prevents viruses from spreading through your device as easily as they could with a Windows machine. 

However, with more people using Apple computers and devices, hackers are starting to focus more on creating Mac-specific malware (such as the Silver Sparrow malware discovered in 2021 [*]).

Here are some warning signs that your Mac has been infected:

• Your device is slow or crashes all the time. Malware can be resource-heavy and cause your computer to act slowly or crash repeatedly — such as crypto mining malware that uses your device’s resources to secretly mine cryptocurrency. Other warning signs could be shorter battery life or web pages and apps that take a long time to load. 
• Strange apps, files, or folders appear. Some computer viruses install new apps or files on your device without your knowledge. These apps may run secret scripts in the background and steal information from you while you use your computer.
• You’re bombarded by constant pop-ups. Many viruses are actually adware designed to make extra money for malicious advertisers. If your browser is taken over by pop-ups, your device could be infected.
• You see a ransomware notice when you start your computer or browser. If you receive a ransomware notice, it’s a clear indicator that someone has gained unauthorized access to your device.
• You can’t access personal files. Some ransomware attacks work slowly over time, encrypting files gradually before starting an extortion attempt. If you lose access to important files, it might mean a ransomware attack is underway.
• Your browser or homepage suddenly changes. Some adware and spyware viruses change your internet browser settings. These changes direct you to websites controlled by hackers who hope to infect your device with even more malware.
• Unexpected apps launch automatically or run in the background. Many viruses work by downloading additional apps and scripts that run while you use your computer. If unrecognized apps keep launching themselves on your device, it may be infected.
• Your passwords for online accounts no longer work. If hackers use malware to steal your login credentials, they may gain access to your email account or your online bank account. The first thing they’ll do is lock you out by changing your password.
• Your computer is hot or making strange sounds. Malware developers don’t check their software for compatibility issues the way legitimate software companies do. If your Mac is infected, it may start doing unexpected things when faced with poorly coded malware.
• Your contacts are receiving strange emails or messages from you. If cybercriminals gain access to your email or social media account, they might use it to spread the infection to your network.

The bottom line: Mac malware is a real problem and can also be a warning sign of larger issues, such as identity theft and fraud. To protect yourself, consider signing up for Aura’s award-winning digital security solution.

How To Remove Malware From Your MacBook or Mac Computer

1. Start your Mac in Safe Mode
2. Update to the latest version of MacOS
3. Download and install Mac antivirus software
4. Check Activity Monitor for suspicious apps
5. Remove browser extensions
6. Clear your downloads folder and cache
7. Disable suspicious login items
8. Secure your online accounts
9. Factory reset your Mac
10. Consider signing up for a digital security app

If you notice any warning signs indicating that your Mac computer has been infected with a virus, you’ll first want to disconnect from your Wi-Fi connection to limit the damage that the virus can do (and stop it from sending your personal data back to the hacker). 

Once offline, here’s what to do next: 

1. Start your Mac in Safe Mode

All Mac computers support Safe Mode, which disables third-party apps and login items from loading. Rebooting your Mac into Safe Mode can prevent some viruses from activating, which gives you the ability to troubleshoot your device and run disk utility programs.

Here’s how to boot your (Apple Silicon) Mac into Safe Mode:

• First shut down your Mac and wait a few seconds.
• Hold the Power button until “Loading startup options” appears.
• Select which startup disk you want to use; then press and hold the Shift key.
• Click on Continue in Safe Mode.

Pro tip: Verify that your Mac is in Safe Mode by looking for “Safe Boot” in the menu bar. For advice on how to enter Safe Mode on an older Mac, read Apple’s guide here.

2. Update to the latest version of MacOS

One of the main reasons Mac computers have so few viruses is that Apple regularly releases fixes to known vulnerabilities via software updates. If you’re running an older version of MacOS, updating your operating system could be enough to remove the virus. 

How to update your Mac to the latest version of MacOS:

• Open the Apple menu in the top corner of your screen, and choose System Settings.
• On older Mac computers, this may be listed as System Preferences.
• Click on General and then on Software Update.
• Install the latest version of MacOS.

3. Download and install Mac antivirus software

If updating your operating system didn’t fix the issue, reboot in Safe Mode and then install a reputable antivirus on your computer. 

High-quality antivirus software can scan your computer for malicious apps, scripts, and potentially unwanted programs (PUPs) that Apple’s built-in security tools might have missed. It will also provide you with clear instructions on how to uninstall any viruses or malware that it finds.

4. Check Activity Monitor for suspicious apps

Activity Monitor is an app that shows detailed information about every process and task your Mac computer executes in real-time. It will show many tasks associated with your operating system, as well as any apps that are currently running. If a virus is running additional apps in the background, they will show up here too.

How to access and check Activity Monitor for malware:

• Open the menu bar, click on Go, and then select Utilities.
• Double-click on Activity Monitor.
• A window with technical information will display. Look for apps and processes that don’t appear to be connected with your apps or the MacOS operating system.
• Verify your suspicions by searching for process names on Google. For example, you might look for “[Process name] + malware” to see if anyone else had the same experience as you.
• If you decide to shut down a process, highlight it and click on Quit Process.

5. Remove browser extensions

Some viruses live in your computer’s web browser. You may have accidentally downloaded malicious browser extensions that compromised your device. Most of these software plugins do useful things like customize your web browsing experience, but some can spread malware to your device.

When you reboot your Mac into Safe Mode, these extensions are disabled. If your computer works normally in Safe Mode, it might mean your extensions are to blame. 

Here’s how to find and delete browser extensions in the most common web browsers:

• Apple Safari
• Google Chrome
• Mozilla Firefox
• Microsoft Edge

6. Clear your downloads folder and cache

Your downloads folder is another area of your computer that can host viruses and malware. You can find the downloads folder easily by looking on the sidebar in Finder. Simply highlight all of your recent downloads and delete them.

Your Mac computer’s cache is a little different. This is where it stores temporary files that help it run faster when accessing the internet, such as images and cookies from websites you visit frequently. Some hackers disguise viruses as temporary cache files specifically for this purpose.

Here’s how to clear your Mac’s temporary cache:

• Open Finder and hit Shift + Command + G to access the Go to Folder function. 
• Type “~/Library/Cache” to open the folder. 
• Highlight everything in the folder and delete it to remove any potentially malicious files that may be stored there.

7. Disable suspicious login items

When you boot your computer in Safe Mode, it disables all apps that start automatically at login. Many viruses download extra apps and force them to run the moment you log in to your computer, so removing these can help resolve the issue. 

How to find and disable login items on your Mac:

• Open the System Settings app.
• Click on General settings in the sidebar, and select Login Items.
• Review the list of apps set to automatically open at login. Remove apps you don’t recognize, and delete apps that look suspicious.

💡 Related: How To Get Rid Of the Apple Security Alert and Mac Pop-up Scams →

8. Secure your online accounts

If your computer has been infected with a virus, hackers may also have access to your online accounts and passwords. It’s a good idea to update your account credentials and enable two-factor authentication (2FA) if you haven’t already. 

Here’s what to do: 

• Start with your most important accounts first. Focus on accounts that can cause the most damage — such as your online banking, email, and social media accounts. Log in to each one, and update your credentials by creating a unique password for each account that is at least 10 characters long and uses a combination of uppercase and lowercase letters, numbers, and symbols.
• Enable 2FA by using an authenticator app. 2FA is one of the best methods to prevent scammers from accessing your accounts — even if they have your password. While most people use SMS texts for receiving 2FA codes, these can be intercepted. Instead, opt for an authenticator app like Authy.
• Store all of your logins in a secure password manager. A password manager doesn’t just store your passwords; it can also warn you if they’ve been compromised or are too weak. Every Aura account includes a secure password manager to keep your accounts safe.

9. Factory reset your Mac, or restore to an earlier (virus-free) backup

If you have followed all of the above steps and still suspect your Mac has a virus, you may need to restore it to an earlier state. 

If you have a disaster recovery application installed, you should have a set of comprehensive backups that you can use to restore your device. Simply choose a restore point from before the virus infection occurred, and continue using your computer from there.

If you don’t have any backups, you may need to reset your Mac to its factory settings. 

Mac OSX lets you do this from the device’s System Preferences menu. You will be asked to confirm multiple times. Beware that restoring your Mac to its factory settings will erase all of your content and apps.

Pro tip: Even a factory reset may not be enough. Some viruses are advanced enough to infect your computer’s operating system or firmware. This embeds them so deeply in the device that they can survive a complete factory reset and reactivate the moment you turn your computer back on. Instead, use a high-quality Mac antivirus.

10. Consider signing up for an all-in-one digital security provider

Getting rid of viruses is much harder than preventing them from infecting your device in the first place. 

With Aura, you get powerful device security features (such as antivirus, a military-grade VPN, password manager, Safe Browsing tools, and more) bundled with optional award-winning identity theft protection, credit monitoring, 24/7 U.S.-based White Glove Fraud Resolution support, and a $1 million identity theft insurance policy.

Do Macs Really Need Antivirus Software?

Apple works hard to make its Mac computers, iPhones, and iPads some of the most secure devices available. 

All Mac computers have built-in firewalls and virus protection features that can stop most — but not all — malware infections. This includes Mac security measures like XProtect, Automatic Quarantine, Sandboxing, and Apple’s own Malware Removal Tool.

Apple also regularly conducts research of threats impacting its iMac computers, iPhones, and iPads, and releases security updates to address these threats – but it can’t catch all MacOS and iOS security threats at once.

Cybercriminals have found ways to bypass these protections and compromise Mac devices by using backdoor vulnerabilities, trojan horse malware, and other cybersecurity exploits. 

Here are some the risks that all Mac users still face:

• Apple’s built-in antivirus may miss modern threats. Apple regularly updates its operating system to secure against vulnerabilities — but it can’t always keep up. Ensuring that your Apple security patches are up-to-date helps, but you could still be susceptible to zero-day vulnerabilities that Apple is unaware of (or is still in the process of fixing).
• Antivirus software can’t protect against social engineering scams and phishing. If hackers trick you into giving up sensitive data like your email password or your Social Security number (SSN), no antivirus software can prevent them from doing damage. To fully protect yourself from scams and fraud, you need to detect phishing and social engineering attacks.
• Your account information can be leaked in data breaches. If a company with which you shared sensitive information gets hacked, your data may end up in the hands of cybercriminals. You may not know that your data is vulnerable until you find it for sale on the Dark Web.

The bottom line: You need more than antivirus software. Modern online threats go way beyond viruses and malware. Aura’s all-in-one digital security solution provides protection against viruses, hacking, identity theft, financial fraud, and more — plans start at just $3/month.

How To Keep Your Mac (and Online Accounts) Safe From Hackers

With more than 10 million malware attacks reported per year, owning a Mac is no guarantee against infection [*].

But keeping your data and devices safe from hackers means more than blocking viruses and malware. You also need to keep a vigilant eye out for scams and fraud emanating from many different sources. 

You can improve your overall digital security by practicing solid cyber hygiene and following these tips:

• Only download apps from the official App Store. Apple thoroughly vets all apps in its official store for quality and security. While some malicious apps may sneak through, you should be generally safe if you stick to software in the Mac App Store. 
• Tighten your device’s security settings. You can configure your Mac to only run apps from identified developers that Apple trusts. This can dramatically reduce your risk of falling victim to a malware attack.
• Enable auto-updates on your operating system and apps. Software updates and security patches keep your device safe from malware. Enable automatic security updates so that you don’t lag behind and expose your data and devices to preventable risks.
• Keep regular backups of your important data. Use a disaster recovery system to keep backups of your most important files and apps. This ensures that you will retain access to your data even if a hacker launches an attack against you.
• Pay attention to Gatekeeper alerts. Gatekeeper is a Mac app that warns you when you try to open untrusted apps. Don’t ignore these alerts when they appear. Double-check the app and make sure it comes from a reputable developer that you trust.
• Use strong passwords and 2FA on all of your accounts. Never reuse passwords across devices and accounts. Consider using a password manager to protect your digital identity from hackers and ransomware attacks.
• Look for the warning signs of phishing scams. Learn how to recognize spoofed websites that can leak your data to hackers. Don’t respond to unsolicited conversations from strangers online.
• Never click on unknown links or download strange attachments. Most viruses and malware spread through malicious links and email attachments. Avoid opening these unless you are absolutely certain they are coming from trusted sources.

Finally, for the best protection, rely on Aura’s all-in-one suite of digital security tools. Aura can protect you and your family from viruses and malware — and also give you the tools and support you need to address fraud and identity theft risks. 

And if the worst should happen, you’ll be covered 24/7 by Aura’s U.S.-based team of White Glove Fraud Resolution Specialists and up to $1 million in identity theft insurance.

Secure yourself against scammers and hackers with Aura — plans start at $3/month.