Mac Security · Mac Malware: Myth vs Reality · Lesson 4 of 5

If You Think Your Mac Is Infected

A calm, step-by-step plan for a Mac you think has malware.

First steps on a worrying Mac

Maybe your Mac is acting strange. Maybe you typed your password into a box you now doubt. Or a friend says you sent them odd messages. Don't panic. Take it one step at a time.

Step 1: Disconnect. Turn off Wi-Fi from the menu bar, or unplug the network cable. This stops malware from sending more of your data out. It also cuts off anyone who may be controlling the Mac from far away.

Step 2: Check Login Items. Malware often sets itself to start every time you log in. Open System Settings › General › Login Items & Extensions. Look at the list under Open at Login, and at the apps allowed to run in the background. Turn off anything you don't recognize. If you're not sure what something is, write the name down and look it up later on another device.

Step 3: Check profiles. Open System Settings › General › Device Management, as in the last module. Remove any profile you didn't add, unless it's a work or school Mac.

Step 4: Remove unknown apps. Open Finder and click Applications. Look for apps you don't remember installing, especially recent ones. Drag them to the Trash, then empty the Trash. Also check your Downloads folder for the file that started it all, and delete that too.

Step 5: Restart and watch. After a restart, see if the strange behavior is gone. Activity Monitor, which you met earlier, can show a program you don't know using lots of power. Don't quit system processes you don't understand, though.

While you work, don't sign in to your bank or email on this Mac. If an info-stealer is still running, it could catch those logins too.

Passwords, reinstalling and help

If you typed your password into a fake box, or opened something that turned out bad, assume your saved passwords and cookies were taken. Act soon.

Change passwords from a clean device. A clean device is one you trust, like your phone or another computer. Don't use the infected Mac, because a stealer could catch your new passwords too. Start with the most important:

1. Your email, since it can reset everything else.
2. Your Apple Account.
3. Banking and payment accounts.
4. Anything else with a password saved on that Mac.

After each change, choose to sign out of all other devices or sessions if the site offers it. That kicks out anyone using stolen cookies. Turn on two-step verification too. If you kept a crypto wallet on that Mac, move the money to a new wallet from a clean device, since a thief may be able to open the old one.

If card details were saved in your browser, tell your bank.

Reinstall macOS as a last step. If problems keep coming back after cleanup, you can erase the Mac and reinstall macOS from macOS Recovery, which you learned about earlier. Erasing deletes everything, so back up your documents and photos first. Copy back only your files, not old apps, so the malware doesn't return.

Get help. You don't have to do this alone:

• Contact Apple Support or visit an Apple Store.
• On a work Mac, call your IT team right away, before trying to fix it yourself.
• If money was taken, call your bank. In the US, you can also report it to the FTC at ReportFraud.ftc.gov.

Be wary of anyone who contacts you first offering to fix your Mac. That's a common scam.