How to Remove Malware from a Mac (Step-by-Step, 2026)

Macs get malware less often than Windows PCs, but the idea that macOS is immune is a myth. The most common infections aren’t dramatic viruses — they’re adware, browser hijackers and “potentially unwanted programs” (PUPs) that sneak in with fake Flash updaters, cracked apps, or bundled installers. They flood you with pop-ups, redirect your searches, and slow everything down. The good news: most of them can be removed by hand with the steps below, no paid software required to get started.

Signs your Mac may be infected

• Safari or Chrome redirects to a search engine you didn’t choose (Bing-lookalikes, “Search Marquis”, “Search Baron”).
• Pop-up ads appear even on sites that don’t normally show them, or fake “Your Mac is infected” warnings.
• A new browser extension, homepage, or default search you never installed.
• The fans run hard and the Mac feels slow when you’re barely doing anything.
• Apps you don’t recognize appear in Applications or launch on their own.

Any one of these can have an innocent cause, but several together usually mean adware or a PUP is running.

Step 1 — Quit suspicious apps and disconnect if needed

Open Activity Monitor (Applications → Utilities) and look under the CPU and Memory tabs for processes with odd names you don’t recognize or that are using a lot of resources. Select anything clearly suspicious and click the ✕ to quit it. Don’t force-quit things you can’t identify — note the name and search it first.

If you think credentials may be at risk, disconnect from Wi-Fi while you clean up, and reconnect only to download tools or updates.

Step 2 — Remove unknown apps from Applications

Open Finder → Applications and sort by Date Added. Malware often installs around the same time something went wrong.

• Drag any app you don’t recognize or didn’t install to the Trash, then empty it.
• Watch for fake “cleaner”, “media player”, or “MacKeeper”-style utilities and apps with generic names.

Removing the app is only half the job on macOS — leftover helper files and login items often remain, so don’t stop here.

Step 3 — Clean up Login Items and background allowances

Adware loves to relaunch itself at startup.

1. Open System Settings → General → Login Items.
2. Under Open at Login and Allow in the Background, remove anything you don’t recognize by selecting it and clicking the – button.
3. Be conservative: leave entries that clearly belong to apps you trust.

Step 4 — Delete malicious Configuration Profiles

This is the step most people miss, and it’s where stubborn browser hijackers hide.

1. Open System Settings and look for a Privacy & Security → Profiles entry (it only appears if a profile exists).
2. If you see any profile you didn’t deliberately install — especially something controlling browser or DNS settings — select it and click – to remove it.

A leftover profile can re-apply a hijacked search engine every time you delete it from the browser, so clear it here first.

Step 5 — Reset your browsers

With the profile gone, clean the browsers themselves.

Safari: Go to Safari → Settings → Extensions and uninstall anything unfamiliar. Under General, fix your homepage, and under Search, reset your default search engine. Then History → Clear History.

Chrome: Open Settings → Extensions and remove unknown items. Go to Settings → Reset settings → Restore settings to their original defaults to undo hijacked search and startup pages.

Firefox: Use Help → More troubleshooting information → Refresh Firefox.

Step 6 — Run a reputable on-demand scanner

After manual cleanup, a second opinion catches leftovers. Malwarebytes for Mac has a free version that scans on demand and is well known for removing Mac adware and PUPs — it’s one of the picks in our roundup of the best free malware removal tools. Download it only from the official site (malwarebytes.com), run a full scan, and quarantine whatever it flags. Reboot when prompted.

Step 7 — Update macOS and your apps

Many infections rely on outdated software. Open System Settings → General → Software Update and install everything available, including Safari updates. Then update your other apps from the App Store or their official sites. Staying current closes the holes adware uses to get back in.

Step 8 — Secure your accounts after cleanup

If you saw fake login pages, browser redirects, or a keylogger-style PUP, treat your passwords as potentially exposed. Once the Mac is verified clean:

• Change passwords for your important accounts (email first — it’s the recovery hub for everything else) from a device you trust.
• Turn on two-factor authentication wherever it’s offered.
• Use a password manager so you’re not reusing the same password across sites.

When to consider stronger measures

If pop-ups keep coming back, profiles reappear, or scans keep flagging the same threat, you may have a deeper PUP or a rare piece of macOS malware. In that case, back up your personal files (not apps), and consider erasing and reinstalling macOS from Recovery for a guaranteed clean slate.

Work through the steps in order — quit, uninstall, clear login items and profiles, reset browsers, scan, update, secure accounts — and the vast majority of Mac infections come off without a full reinstall.