Do Macs get viruses? Do Macs need antivirus software? The answer isn’t as simple as it may seem. In this article, we look at the dangers faced by Mac users and the pros and cons of using Mac antivirus software.
The Mac has historically been considered to be safe and secure for a number of reasons that we will go into below, but in recent years that has shifted considerably. In its report on the State of Malware in 2019 here, Malwarebytes said it saw a: “Significant rise in the overall prevalence of Mac threats, with an increase of over 400 percent from 2018”.
The good news is that in 2020 the amount of malware detected on macOS actually decreased by 38 percent, according to the same security company. But before you breathe a sign of relief, Malwarebytes states that the worst kind of malware, namely “backdoors, data stealers, and cryptocurrency stealers/miners, increased by more than 61 percent” in 2020.
So should Mac users start panicking now? To some extent there is reason for concern, but there are measures put in place by Apple at the operating system level that should protect Mac users from the worst malware threats.
As we will discuss below, the Macs remains pretty secure thanks to a number of built-in security features that make attacking a Mac particularly challenging. These include Gatekeeper, which blocks software that hasn’t been digitally approved by Apple from running on your Mac without your agreement, and XProtect, which is Apple’s own antivirus built in to macOS. More on those security features below.
Are there Mac viruses?
The word virus gets used a lot more than it should be – a more accurate word would be malware. A computer virus is so called because it is capable of replicating itself and spreading. A virus is only one type of malware of which there are many, and unfortunately there have been cases on the Mac.
We have a complete list of Mac viruses and malware in a separate article, but to summarise, Malware includes the following:
Adware: Once this malicious software is installed on a Mac it will show advertisements and pop ups for software – most likely for Potentially Unwanted Programs like those we will discuss next. According to Malwarebytes: “macOS’ built-in security systems have not cracked down on adware and PUPs to the same degree that they have malware, leaving the door open for these borderline programs to infiltrate”.
Potentially Unwanted Programs (or PUPs): Famous examples include MacKeeper, Advanced Mac Cleaner, Mac Adware Remover, and Mac Space Reviver. These apps tend to hound users, which is part of their downfall, as due to the bad reputations of some of these apps the number of Macs affected has fallen, according to Malwarebytes. So it seems that people are at least wising up to these dodgy programs.
Ransomware: Ransomware has been detected on Macs – although the most recent case ThiefQuest / EvilQuest – didn’t actually work very well and was quickly identified and stopped.
Cryptocurrency miners: Criminals have attempted to use Macs to mine bitcoin and the like as in the case of LoudMiner (aka Bird Miner).
Spyware: Our data is incredibly valuable to criminals and spyware is designed to obtain this information.
Phishing: We’ve all received phishing emails and we all know the dangers, but as criminals get more sophisticated (and maybe even learn to spell) can we be sure we won’t fall for a phishing attempt to gain our data or log in details.
Trojan Horse: A Trojan is a kind of malware that is hidden, or disguised in software. There are various kinds of Trojans. A Trojan could, for example, give hackers access to our computers via a ‘backdoor’ so that they can access files and steal your data. Essentially the name Trojan describes the method by which the malware gets onto your computer.
USB/Thunderbolt hack: There have also been cases where malware has been installed on Macs via a modified USB cable. There have even been security flaws associated with Thunderbolt which are discussed in this article: How to protect your Mac from the Thunderbolt security flaw.
It’s clear from these cases that there is a threat from malware on the Mac, and there are likely to be more cases in the future. Even the M1 Macs that use ARM-based Apple chips and were introduced in November 2020 have already been targeted, with Silver Sparrow malware targeting both M1 Macs and Macs that use Intel processors.
One good thing is that Adobe ended support for Adobe Flash on 31 December 2020. At least this should reduce the number of cases of Mac malware disguised as the Flash Player arriving on the Mac.
Do Macs need antivirus?
Having just demonstrated that there is a the risk posed by Mac malware you might be thinking that it’s clear that Macs need antivirus, but that’s not necessarily the case.
Apple goes to great lengths to protect you from malware by making it almost impossible for you to download it in the first place, let alone install it.
For example, Apple has anti-malware protection known as XProtect built into into macOS that inspects every app for malware. Apple also has Gatekeeper, a feature of macOS that checks that any app you attempt to open or install has come from a certified developer.
Thanks to these features, before you can install an app, your Mac will check it against a list of malware, and even if there is no reason for concern it will not make it easy for you to open an application from a developer that it hasn’t approved.
In the next section we’ll run through all of these macOS specific features that should keep you safe from Mac malware, but keep on reading to find out why they may not be enough.
How Apple protects Macs from viruses
Macs are generally safer than PCs, but with the threat to the Mac growing due to the increasing popularity of the platform (both with consumers and with those who wish to target Mac users) Apple has had to build in protections to macOS and the Mac hardware itself.
In this section we will look at the inbuilt protections in macOS and will establish whether they are enough, or if you should also install antivirus software on your Mac.
How XProtect works
The Mac’s malware scanning tool, XProtect, works invisibly and automatically in the background and requires no user configuration. Apple has a list of malicious applications that it checks against when you open downloaded applications. XProtect is regularly updated by Apple, and it updates in the background, so you should always be protected.
This is similar to having antivirus software from a third party software developer running on your Mac, with the bonus of being written into the operating system and therefore it doesn’t hamper the speed of your Mac.
If you download and try to open files contaminated with malware, you may see an explicit warning that the files will “damage your computer”, along with a reference to type of malware. In that case you should delete the file immediately.
This is great news for Mac users, but is it enough? How does XProtect compare to the antivirus solutions out there? Well, XProtect may not be as up to date as some of the solutions and it doesn’t look for as many strains of malware as the third-party solutions do. Read our round up of the Best Mac Antivirus Apps.
How Gatekeeper works
Thanks to Gatekeeper, macOS blocks downloaded software that hasn’t been digitally signed – a process in which Apple approves the developer. This leads to the familiar error message when you try to use or install unsigned software: “[this app] can’t be opened because it is from an unidentified developer.”
GateKeeper can protect you by only installing software downloaded from the Mac App Store, or you can set it to allow you to install software from the web – but from verified developers.
One change to Gatekeeper that arrived in macOS Catalina includes software being checked for malware and other issues every time it runs, rather than just the first time you install it.
You can adjust these settings via the Security & Privacy section of System Preferences:
- In Security & Privacy select the General tab
- Choose from the options underneath Allow Applications Downloaded From.
- Choose App Store or App Store and Identified Developers.
The safest option is App Store only, but if you also want to be able to install legitimate software from the web then App Store and Identified Developers is the best plan.
There used to be a further option to disable the feature by choosing ‘Anywhere’ but this option is no longer available.
All software downloaded via the App Store is signed, but should you attempt to open an app you have downloaded from the web that isn’t signed , you’ll only see a Gatekeeper warning like the one below:
This may mean that you have almost installed malware. Of course it may be a legitimate app in which case you can bypass Gatekeeper’s protection and install it.
To do so, go to the Finder and locate the app there. Now hold down Ctrl when you click on the app to open it and then select Open. This will mark it as being trusted. For more details on how to do this read: how to open an app from an unidentified developer.
This latter point might sound like a benefit, but it basically enables you to completely bypass the protections offered by Gatekeeper – and more and more malicious apps are instructing users to do exactly this when they are installed.
Sandboxing on the Mac
Software that is approved by Apple is also Sandboxed, which means apps do only what they’re intended to do. App sandboxing isolates apps from the critical system components of your Mac, your data and your other apps, so they shouldn’t be able to access anything that could allow them to do any damage.
It doesn’t protect you from malware but it does limit what the malware can do.
The main problem here is that while apps sold on the Mac App Store have to be sandboxed, other Mac apps don’t.
However, even without sandboxing, there are features built into macOS that should still stop apps snooping on your data. Since macOS 10.15 Catalina in 2019 it has been a requirement for all Mac apps to get your permission before they can access your files.
macOS will also ask for your permission before an app is able to access the camera or microphone, or log what you type, for example.
Another change that arrived with Catalina is that macOS itself is now stored on a separate disk volume (if you look in Disk Utility you’ll see your usual Home volume and a separate Home – Data volume). This means that your important system files are all completely separate and therefore more challenging to access. This should mean that no apps can get to your system files where they could cause problems.
There is anti-phishing technology in Safari that will detect fraudulent websites. It will disable the page and display an alert warning you if you visit a suspect website.
Anti-phishing isn’t the only way that Safari protects you when you are surfing. Apple also allows users to stop advertisers tracking them around the web. You can see a Privacy Report including details of all the cross-site trackers Apple has stopped from profiling you.
You’ll also notice that plug-ins such as Silverlight, QuickTime and Oracle Java won’t run if they aren’t updated to the latest version – another way of ensuring your Mac is safe. And of course now that Adobe has discontinued Flash people should hopefully no longer fall for malware hidden in the Flash Player.
Safari will also flag up insufficient passwords and make strong password suggestions when you open an account on a website. This strong password will be saved in your iCloud Keychain so that you won’t have to remember it. It’s a lot safer than using the same password you always use. You’ll also be seeing warnings if you try to use a weak password and a prompt to change it to something safer.
File encryption with FileVault
In addition to Gatekeeper, which should keep malware off your Mac, FileVault 2 makes sure your data is safe and secure by encrypting it.
If you are concerned about someone being able to access the files on your Mac you can encrypt them using FileVault, which will mean only you can unencrypt them. Read our tips for keeping your mac secure, of which using FileVault is one.
How Find My works
Not every threat to your data comes from malware – sometimes a criminal might get hold of your Mac, in which case Apple’s Find My service will come into its own.
The Find My app can relay location of your lost or stolen Mac back to you. If you are concerned that it might not be recoverable you can wipe the contents of the Mac so that your data can’t be accessed.
In addition, all Macs with the T2 chip have an Activation Lock feature that means they can be able to brick the Mac remotely.
When Apple’s security measures aren’t enough…
All the above is great, but unfortunately there have been cases where Gatekeeper has been bypassed because malware has got an approved developer signature. For example OSX/CrescentCore was able to bypass Gatekeeper because it was signed by a certificate assigned by Apple to a developer. It took Apple a few days to retract that certificate.
It isn’t only when malware get’s a certificate from a registered developer. In the case of OSX/Linker, a zero-day vulnerability in Gatekeeper was being exploited.
Zero-day threats mean there are “zero days” to fix the vulnerabilities, although often a legitimate developer discovers the vulnerability and lets the developer know about it. There is usually a 90-day deadline for the fix to be made available. Some times the developer doesn’t act in time and the exploit is publicised.
Apple normally reacts quickly, although there have been cases where the company has ignored the identified vulnerability, such as when a teenager reported the Group FaceTime vulnerability that meant someone could listen in to a call and Apple failed to act. There’s more about how Apple reacts to security threats next.
When Apple is made aware of a threat the company usually issues a security update to the latest version of macOS and to the two versions prior to it. This way Apple will protect users from vulnerabilities and flaws in macOS that could be utilised by hackers.
Normally the advice would be to install the update immediately. However, for example a Sierra and High Sierra security update in July 2019 was subsequently pulled after people experiences problems after installing it.
How Apple responds to security threats
Despite the security measures Apple has in place, from time-to-time there are threats to the Mac.
Apple has its own security research team, but it depends on users and independent researchers to help by reporting any flaws they find in Apple products.
To this end, Apple has an incentive program that rewards such discoveries with payments of up to $200,000, depending on the seriousness of the flaw. But it was the last major tech company to set up such a scheme. (Microsoft set up its own bug-reporting incentive programme in 2013, and was itself criticised at the time for leaving it so late.)
On 4 August 2016, Apple security boss Ivan Krstic announced the Apple Security Bounty Program. “We’ve had great help from researchers in improving iOS security all along,” Krstic said. “[But] we’ve heard pretty consistently… that it’s getting increasingly difficult to find some of those most critical types of security vulnerabilities. So the Apple Security Bounty Program is going to reward researchers who actually share critical vulnerabilities with Apple.”
The top reward is $200,000, given to those who discover vulnerabilities in Apple’s secure boot firmware components; for less critical flaws the bounties drop through a series of smaller figures to a bottom tier of $25,000. Wired has the details.
We imagine most Mac users will be pleased to hear that Apple has an incentive programme to encourage more widespread reporting of its vulnerabilities. Incentivising security researchers to let Apple know about a flaw instead of passing it on to hackers (which may still, sadly, be more lucrative) makes Apple products safer for everyone.
One such flaw was the High Sierra root bug, discovered on 28 November 2017. This flaw in macOS 10.13 could allow access to settings on a Mac without the need for a password. Apple immediately issued a statement confirming that it was working on a fix and an update was anticipated to be issued within days.
How to keep your Mac safe from malware
Apple does a lot to keep your Mac safe, but you have to work with it, installing updates when they arrive, not clicking on suspicious links in emails, not installing Flash, and so on. There are also some third party antivirus apps you could try – we have a complete guide to the best antivirus for Mac here.
Here are a few of the things you should do:
1) Keep macOS up-to-date
Despite what we said above about the security update Apple later retracted, normally the advice would be to install a security update as soon as possible.
Apple addresses flaws and vulnerabilities with the Mac by issuing updates to the Mac operating system, it is important to keep your Mac up to date. We advise checking regularly for OS updates remains a key part of a sound security strategy.
You can set your Mac to automatically update as soon as a new version of the operating system is made available. Follow these instructions to set that up:
How to automatically install macOS updates
- Open System Preferences.
- Click on Software Update.
- Tick the box beside Automatically keep my Mac up to date.
- Or, click on Advanced and choose from automatically: Check for updates, download new updates when available, Install macOS updates and Install app updates from the App Store.
How to automatically install High Sierra or older software updates
- Open System Preferences.
- Click on App Store.
- Tick the box beside Automatically check for updates.
- You can choose to download the newly available updates, if you want them to install automatically though you need to make sure the box beside Install macOS updates is checked.
How to manually install macOS software updates
If you’d rather not let your Mac automatically update, you should periodically check to see if there is an update to your version.
- In High Sierra and earlier you can go to the Mac App Store and check for updates.
- In Mojave and newer you need to go to the Software Update pane in System Preferences.
You may need to restart your computer once the update has downloaded. You can expect a typical 460MB download to take about 8 minutes (during which time you will still be able to work) but for a large update you will have to restart and install and that could take as much as 20 minutes, bringing the total install time to about 25 minutes in total.
For our in-depth guide to updating Mac operating systems, see How to update macOS.
2) Don’t connect to public Wi-Fi networks
Beware of connecting to a public Wi-Fi network as there may be someone spying who could gain access to your passwords and other private information, or you could have your session hijacked. Snoopers can set up their own Wi-Fi hotspot, pretending to be your hotel or coffee shop, then once you have connected they can grab any data you send over it. In the past there have been flaws detected in the OS that could allow access to your Mac, such as the SSL error in an earlier version of Mac OS X that meant it was possible for a hacker to access your machine if you were using public WiFi.
3) Don’t install Flash
Adobe has discontinued Flash as of December 31 2020 and there is good reason. Intego, Malwarebytes and others recommended that you shouldn’t install Flash Player. Fake Flash Player updates have often been the means by which people install malware. For example, people want to watch or download a popular movie or TV series for free and they find a search result that leads to a request to update Flash Player in order to view the content. There is no need to install Flash Player now that HTML5 has made Flash obsolete. Now that Flash is no longer be supported the advice is simple: Don’t use Flash!
4) Keep Java up to date on your Mac
If you must use Java (which is also problematic) then make sure it’s up-to-date. Vulnerabilities with Java have highlighted the fact that there are cross-platform threats that even Mac users need to be aware of. Apple blocks Java by default, leaving it to the user to decide whether to install those tools. If you do need to update them be very careful where you download updates from!
5) Avoid falling foul of phishing emails
Protect yourself from phishing attacks not responding to emails that require you to enter a password or install anything. You could also use free software such as BlockBlock or XFence (formerly Little Flocker) installed. That way even you were to carry out the steps to launch the malware, it would not be able to write files or mark itself as launching on startup.
6) Don’t fall for Facebook scams
Facebook scams are usually designed to harvest data about the most gullible people, so if it seems like it might be too good to be true it probably is and you’d be wise not to share it on Facebook. At best you might just look silly and those scammers will start to target you with more scams, at worse scammers can access your personal data and that of those you share their post with. So don’t click on a link just because a friend shared it and definitely don’t give out your personal data on Facebook.
Is antivirus software necessary for a Mac?
As we’ve explained above, it’s certainly not an essential requirement to install antivirus software on your Mac. Apple does a pretty good job of keeping on top of vulnerabilities and exploits and the updates to the macOS that will protect your Mac will be pushed out over auto-update very quickly.
However, sometimes Apple doesn’t respond as quickly as Mac users might hope. In that case, there are some free and paid for antivirus apps that might give you some peace of mind.
Beware that due to the fact that people are so concerned about malware threats on the Mac there have been cases of malware actually disguising itself as an antivirus app, most recently Mac Auto Fixer pop-ups have appeared suggesting that software needs to be installed (at a high price). This is similar to another fake antivirus app called MacDefender which has been doing the rounds for some time.
Another Mac antivirus company that is often thought of as unscrupulous is MacKeeper. There are various reports that suggest it is a scam or at worst malware. However, according to reports, MacKeeper is not a scam, but unfortunately, its aggressive advertising leads many to believe that it is, and perhaps it is unfortunately named (too similar to the fake antivirus apps above). There are also complaints that it is difficult to uninstall (and we have a guide to how to uninstall MacKeeper here).
How to tell if a Mac has a virus
Look out for the following signs that your Mac has been infected with malware:
- Aggressive web page banners and browser pop-ups recommending software.
- Web page text turning into hyperlinks.
- Programs appearing that you haven’t authorised.
- Mac crashes.
- Mac runs hot.
- Mac speeds up for no reason.
If you think something suspicious is happening, open Activity Monitor and click on the CPU tab. Check what software is running – especially if something is hogging a lot of your resources.
We discuss how to tell if your Mac has a virus and how to remove a Mac virus in a separate article: How to remove a virus from a Mac.