Despite common misconceptions, and Apple’s best efforts, Mac malware does exist – but the good news is that Macs offer a high level of built-in malware protection.

Historically, Macs have been considered safe or even immune from viruses and other forms of malware. It’s certainly true that cybercriminals have focussed most of their time and resources on creating malware designed to run on Windows machines, as they make up the bulk of the market and thus offer more lucrative opportunities. However, in the last decade, Apple’s share of the computer operating system market has risen massively, and coupled with Windows users taking security more seriously, cybercriminals are seeking new opportunities.

“Virus” is often used as a catch-all term for any type of malware, but the truth is, they can come in many different forms such as adware, ransomware, spyware and Trojan horses – all affecting Macs. The good news is that the big, high profile malware attacks you’ll occasionally hear about in the news – such as the WannaCry ransomware attack in 2017 – rarely affect Macs. When you factor in that Macs offer a high level of protection against malware, it’s certainly not all doom and gloom. Apple has three main ways: XProtect, Malware Removal Tool (MRT), and Gatekeeper.

XProtect
XProtect, a malware scanning tool, runs invisibly in the background, and checks your Mac for malware. Apple has a constantly-updating list of malicious applications it checks against when opening downloaded software. XProtect requires no user configuration, so you should always be protected against the latest threats. Because XProtect is written into the operating system, it won’t slow down your Mac either, as Windows antivirus software often does. If you try and open files that are infected with malware on the list, the software will be blocked and you’ll be notified, with the option to move it to the Bin.

Malware Removal Tool (MRT)
While XProtect tries to detect malware and prevent it from infecting your Mac, Malware Removal Tool (MRT) can remove malware should it find its way onto your machine. Apple provides pretty much no information about MRT beyond this brief description, and since 2018, Apple has hidden the names of malware which MRT can remove.

Gatekeeper
Gatekeeper is a macOS security feature that enforces code signing, verifying downloaded applications before allowing them to be run, with the aim of preventing malware being inadvertently executed. Only software downloaded from the Mac App Store can be downloaded, or you can set it up to allow software downloaded from the web from verified developers to be installed. From macOS Catalina, software is checked for malware every time it runs, not just the first time it is installed.