Mac Security · Mac Malware: Myth vs Reality · Lesson 1 of 5

Yes, Macs Get Malware

Why Macs are targets now, how fake updates work, and what XProtect does.

The myth and the fake update

Many people believe Macs can't get viruses. That was never quite true, and today it's clearly wrong. Macs are well protected, but they are not immune.

Malware is any software made to harm you or your computer, or to steal from you. A virus is one kind. Most Mac malware today doesn't spread by itself. It's a program you are tricked into opening.

Why do criminals bother with Macs now? A few reasons:

• Far more people own Macs than 20 years ago, including many at work.
• Mac owners have bank logins, work accounts and saved passwords worth stealing.
• Many Mac owners still believe the myth, so they let their guard down.

The most common trick is a fake update. You're reading a website and a box appears: "Your Flash Player is out of date. Update now." It looks official. Clicking it downloads a file, and that file is the malware.

Here's how to spot it. Real updates for macOS come from Software Update, in System Settings › General. App updates come from the App Store or from inside the app itself. A website never needs to update your Mac. Also, Adobe stopped supporting Flash Player at the end of 2020, so any Flash update today is fake.

A fake installer works the same way. A download site offers a popular app, but the file is a lookalike with malware inside. Get apps from the App Store or the maker's own website, and be extra careful with download links in ads.

On the practice computer, notice where the update pop-up appears, open the download to see what macOS does, move it to the Trash, then check Login Items for anything new.

What XProtect blocks

Your Mac has antivirus built in. It's called XProtect, and it runs quietly in the background. You don't need to turn it on or buy anything.

XProtect keeps a list of known malware. Apple's security guide says it checks an app the first time you open it, when the app changes, and when the list is updated. Your Mac looks for a new list every day, separate from normal macOS updates.

When XProtect finds known malware, it stops the app from opening. You see an alert like this: "FlashUpdate will damage your computer. You should move it to the Trash." Click Move to Trash. Don't look for a way around it.

XProtect can also clean up some known malware that already got in. It checks again from time to time, without you doing anything.

Two other layers help. Notarization means Apple scanned an app for known malware before its maker shared it. Gatekeeper is the part of macOS that checks a download before it opens, and warns you when an app isn't notarized.

So what can't these tools do? A few things:

• Brand new malware may not be on the list yet. Criminals keep changing their files to slip past.
• If you click past a warning, you've overruled the safety check.
• They can't stop you from typing your password into a fake website.
• They can't stop you from pasting a scam command into Terminal, which you learned to refuse earlier.

That's why the best protection is you and the Mac working together. Keep macOS up to date so its protections stay current. Download from places you trust. Treat every warning as a stop sign, not a speed bump.