In 2006, Apple advertised that there were no viruses on the Mac. Twenty years on, many users still believe this. But the reality is very different. Threats targeting macOS have exploded in recent years, and security reports confirm that Macs have become a profitable target for cybercriminals.
Why this change? Three main factors: the market share of macOS has increased by 60 % in three years, making the platform more attractive to attackers. Malware kits targeting macOS are now available for a few hundred euros a month on the dark web. Above all, the sophistication of attacks has increased: targeted phishing, fake installers, ransomware and stealers capable of stealing passwords, crypto wallets and bank details.
At Réparation MAC in Brussels, every month we treat Macs infected with adware, malicious browser extensions or spyware. The typical profile? A user who is convinced that their Mac is naturally protected and has downloaded software from an unofficial site.
Apple is not standing still. macOS incorporates several layers of security that work in the background without you having to intervene.
| Protection | Role | Limit |
|---|---|---|
| XProtectBuilt-in anti-malware | Detects and blocks known malware when downloading or running | Only detects threats referenced by Apple (limited database vs. third-party antivirus) |
| GatekeeperChecking apps | Checks that apps are signed and notarised by Apple before they are opened for the first time | Can be bypassed if the user forces it to open (right-click then Open) |
| SIP (System Integrity Protection) | Protects critical system files from modification, even by the administrator | Does not protect user files or third-party apps |
| Sandbox | Isolate App Store apps to limit their access to data | Does not apply to apps installed outside the App Store |
| Firewall | Blocks unauthorised incoming connections | Deactivated by default, does not filter outgoing connections |
| MRT (Malware Removal Tool) | Removes known malware detected by XProtect | Runs only on reboot or during updates |
These protections form a solid defensive system, but they share a common weakness: they are reactive and ad hoc. XProtect checks files on entry but does not monitor continuously. Gatekeeper can be bypassed by the user. And none of these protections protect you against phishing, the number one threat in 2026. For more details, see the official Apple page on macOS security.
| Type of threat | Recent examples | Mode of infection | Danger |
|---|---|---|---|
| StealersData theft | Atomic Stealer, Banshee, Poseidon | Fake installers, booby-trapped advertising | Theft of passwords, cookies and crypto wallets |
| AdwareIntrusive advertising | Pirrit, Genieo, VSearch | Bundled with free software | Redirects, pop-ups, slowdowns |
| Ransomware | LockBit (macOS variants), KeRanger | Booby-trapped attachments and downloads | File encryption, ransomware |
| PhishingPhishing | Fake Apple emails, fake iCloud pages | E-mails, SMS, advertising | Theft of Apple ID, bank details |
| PUPUnwanted programmes | MacKeeper, Advanced Mac Cleaner | Alarmist advertising, false scans | False diagnosis, forced subscriptions |
| User profile | Risk | Antivirus recommended? |
|---|---|---|
| Basic use (web, email, office automation)Apps only from the App Store | Low | Optional (Malwarebytes spot scan is sufficient) |
| Downloading software outside the App StoreThird-party sites, torrents, free software | Medium to high | Yes, real-time protection recommended |
| Professional with sensitive dataCustomer data, accounting, health | High | Yes, complete security suite |
| Mixed Mac/Windows environmentFile sharing between Mac and PC | Medium | Yes (also protects PCs on the network) |
| Family with children | Medium | Yes (parental control + web protection) |
| Advanced user / developerRisk awareness and best practice | Low | Optional (Malwarebytes one-off + vigilance) |
We have selected the most reliable solutions, tested by independent laboratories AV-TEST and AV-Comparatives, and compatible with the latest versions of macOS.
| Antivirus | Type | Price/year | Highlights | Weak points |
|---|---|---|---|---|
| MalwarebytesOur free recommendation | Free (scan) / Premium | 0 (free) / €45 | Lightweight, fast scan, excellent for adware | No real-time protection in the free version |
| Intego Mac Internet SecurityDesigned for Mac | Paying | From €25 | Developed specifically for macOS, minimal impact | No free version, no VPN included |
| Bitdefender Antivirus for Mac | Paying | From €30 | Excellent malware and phishing detection, lightweight | Advanced functions reserved for the Premium version |
| Norton 360 | Paying | From €30 | Complete suite (VPN, mdp manager, firewall) | Heavier than the alternatives, impact performance |
| Avast Security (free) | Free / Premium | 0 € / 50 € | Free real-time protection, web shield | Collection of user data (privacy policy) |
The most effective anti-virus software remains your vigilance. Here are the practices we recommend to all our customers, whether or not they use antivirus software.
| # | Good practice | Why it's important |
|---|---|---|
| 1 | Keeping macOS up to date | Updates correct actively exploited security vulnerabilities |
| 2 | Download only from the App Store or official websites | Eliminates 90 % risks of infection |
| 3 | Never force open an unsigned app | If Gatekeeper blocks an app, it's probably for a good reason |
| 4 | Activate the firewall | System settings then Network then Firewall then Activate |
| 5 | Activate FileVault | Encrypts the entire disk, protects data in the event of theft |
| 6 | Use unique passwords (password manager) | One compromised password doesn't compromise everything |
| 7 | Beware of suspicious e-mails and text messages | Phishing is the No. 1 threat, and no antivirus blocks it 100 % |
| 8 | Backing up with Time Machine | In the event of ransomware, backup is your only way out |
| 9 | Checking browser extensions | Malicious extensions = frequent point of entry |
| 10 | Run a monthly Malwarebytes scan | Detects adware and PUPs that fly under the macOS radar |
Even with all the protection in the world, infection is still possible. Here are the warning signs, based on our experience in the workshop.
| Symptom | Possible cause | Recommended action |
|---|---|---|
| Pop-up advertising | Adware installed in the browser | Malwarebytes scan + check browser extensions |
| Redirects to unknown sites | Extension or DNS modified by malware | Virus cleaning professional |
| Mac abnormally slow for no reason | Malicious background process (crypto miner) | Check Activity Monitor then diagnostic |
| Modified browser home page | Browser hijacker | Reset browser settings + scan |
| Apps you haven't installed | PUP (potentially unwanted program) | Delete app + full scan |
| Ransomware / Encrypted files | Ransomware | Don't pay, restore from Time Machine, contact a professional |
Yes, the term «virus» in the strict sense (self-replicating program) is rare on the Mac, but malware (malicious software in the broad sense) is very real and on the increase. Macs are targeted by adware, stealers, ransomware, phishing and potentially unwanted programs (PUPs). The protections built into macOS reduce the risk but do not eliminate it.
XProtect is effective against known malware referenced by Apple, but its signature database is more limited than that of specialist antivirus software. It checks files on entry but does not continuously monitor them. And it does not protect against phishing, the most common threat. For basic use with good practices, XProtect is sufficient. For high-risk users, an add-on is recommended.
Malwarebytes is our recommendation. The free version provides highly effective on-demand scans for adware, PUPs and malware. For free real-time protection, Avast Security is an alternative, but its data collection policy raises questions. In any case, native macOS protection combined with a monthly Malwarebytes scan covers the needs of most users.
Modern solutions such as Intego and Bitdefender have minimal impact on performance. Independent tests show a slowdown of 2 to 5 % on recent Macs (Apple Silicon). Heavier suites such as Norton can have a more noticeable impact, especially on older Macs. The free Malwarebytes version (one-off scan) has no impact on day-to-day use, as it is not running continuously.
Go to System Settings then Network then Firewall and activate it. It is deactivated by default on macOS. The firewall blocks unsolicited incoming connections, which is an essential basic protection, especially if you use public Wi-Fi networks (cafés, airports).
Signs of infection include: unwanted pop-up ads, redirects to unknown sites, unexplained slowdowns, altered browser homepage, unknown apps in the Applications folder. Run a scan with Malwarebytes and check your browser extensions. If the symptoms persist, a professional virus cleaning is recommended.
A new MacBook benefits from the latest protection in macOS (updated XProtect, Gatekeeper, SIP). For standard use with good security practices, these protections are sufficient. However, we recommend installing Malwarebytes (free) to run a monthly preventive scan, and activating the firewall and FileVault from day one.
FileVault is macOS' full disk encryption system. Once activated, all data on the disk is encrypted and can only be accessed with your session password. This is essential if your Mac is lost or stolen. Activate it in System Settings then Privacy and Security then FileVault. On Apple Silicon Macs, FileVault is activated by default.
Yes, most Mac antivirus software also detects Windows malware. This is useful if you share files with Windows-based colleagues or friends: your Mac could be the healthy carrier of an infected file that doesn't affect you but could infect a PC. Intego, Bitdefender and Norton detect threats on both platforms.
At Réparation MAC in Brussels, our virus and malware removal is available from €75 inc VAT. It includes a full scan, removal of all threats, verification of browser extensions, macOS update and basic protection. Free diagnosis and 180-day guarantee.
Over 15 years of Apple expertise in Brussels. Free, no-obligation quote and 180-day guarantee on repairs.
