Is my Mac infected? The mac malware check I wish I'd run.

List everything set to auto-start

AMOS disguises its persistence as Apple services — labels like com.apple.accountsd, com.apple.service, com.finder.helper. The label looks like Apple, but the plist points at a hidden script in your home directory or /var/tmp/. See how to tell the real from the fake com.apple.accountsd.

# List all LaunchDaemons (system-wide, often requires sudo to see contents)
ls -la /Library/LaunchDaemons/

# List user-level LaunchAgents
ls -la ~/Library/LaunchAgents/

# List system-level LaunchAgents
ls -la /Library/LaunchAgents/

What to look for:

• Labels that mimic Apple naming (com.apple.*) but were not installed by Apple — open the plist and check the ProgramArguments path. If it points at a hidden dotfile or a script in your home directory, that is not Apple.
• Plist files created recently or at an unexpected date — check the file modification timestamp.
• Watchdog loops: a daemon whose sole job is to relaunch another process every few seconds. Look for StartInterval values under 60 in the plist.

# Read a suspicious plist to see what it actually runs
cat /Library/LaunchDaemons/<suspect-label>.plist

# Check for hidden payload dirs that mimic Apple naming
ls -la ~/Library/Application\ Support/.com.apple.* 2>/dev/null

Look for captured credentials and staging files

The malware writes your password to a small hidden file — often with a name like .pass, .pw, or something similarly short — so it can use it for privilege escalation. It also stages browser data (cookies, saved passwords, extensions) before exfiltrating.

# List hidden files in your home directory
ls -la ~/.[!.]*

# Look for short hidden files that could be captured passwords
find ~ -maxdepth 2 -name ".*" -type f -size -1k -newer /var/log/install.log 2>/dev/null

# Check for hidden dirs that mimic Apple in Application Support
ls -la ~/Library/Application\ Support/.* 2>/dev/null

What to look for:

• Short hidden files you did not create — especially anything containing what looks like a password or token.
• Hidden directories in ~/Library/Application Support/ that mimic Apple naming (e.g. .com.apple.accountsd).
• Browser data copies (cookies databases, login JSON) outside the normal browser profile path.

Audit process paths

Look for any process whose binary path is somewhere you wouldn't expect system software to live. /var/tmp/ and hidden dotfile directories are common AMOS staging locations.

# Show all running processes with full paths
ps aux

# Filter for processes running from suspicious locations
ps aux | grep -E '/var/tmp|/\.\w'

# Check what is currently loaded by launchd
launchctl list | grep -v "com.apple"

What to look for:

• Processes running from /var/tmp/, /tmp/, or any hidden directory (path containing /.).
• Process names that mimic Apple services but run from a user-writable path instead of /System/ or /usr/.
• Any process with a name you do not recognize — especially if it started recently and uses network connections.

# Check active network connections for unknown processes
lsof -i -P | grep ESTABLISHED

Download, read, then run the scanner

hardenmac-scan checks for the known AMOS launchd labels, the watchdog relaunch loop, captured-password files, known command-and-control domains, and processes running from suspicious paths.

# Download the scanner
git clone https://github.com/thatswhatworks/hardenmac-scan.git
cd hardenmac-scan

# Read the script before running it — never trust blind
cat scan.sh

# Run it
chmod +x scan.sh
./scan.sh

• Read-only: the script does not modify your system, does not require sudo, and makes no network calls.
• Open source: every line is readable before you run it. That is the point.
• Never pipe a script from the internet into your shell — curl | bash is literally how a lot of these infostealers get installed. Download it, read it, then run it.

Search history for suspicious patterns

The ClickFix/Terminal-paste trick — where a website or ad instructs you to paste a command into Terminal — is the single most common Mac infection vector right now. Your history is the evidence trail.

# Search for curl|bash or curl|sh patterns (the classic pipe-to-shell)
history | grep -iE 'curl.*\|.*(bash|sh|zsh)'

# Search for osascript privilege escalation
history | grep -i 'osascript'

# Check the raw history file for anything your session history doesn't show
grep -iE 'curl.*\|.*(bash|sh)|osascript|sudo.*bash' ~/.zsh_history 2>/dev/null
grep -iE 'curl.*\|.*(bash|sh)|osascript|sudo.*bash' ~/.bash_history 2>/dev/null

What to look for:

• curl|bash or curl|sh patterns: any install script piped directly from the internet into a shell. This is the delivery mechanism.
• osascript commands: AppleScript can pop a fake system dialog asking for your admin password. If you see osascript -e in your history and you don't remember writing AppleScript, investigate.
• Commands you don't remember running: the malware may have run commands as your user. Anything unfamiliar in your history is worth investigating.

Rotate credentials from a different, clean device

Use your phone or another known-good computer — not the suspect Mac. Anything you type into a compromised machine can be captured again.

• Password-manager master password — then check its activity log for unfamiliar sign-ins.
• API keys and developer tokens: GitHub, cloud providers, CI, package registries, AI/LLM keys. Regenerate SSH keys.
• Apple ID and Google: change passwords, review trusted devices, set a recovery key.
• Financial accounts and anything with money attached.
• Sign out of all browser sessions everywhere — stored cookies were stealable, so a password change alone is not enough.

Then follow the full recovery checklist

The recovery checklist walks through everything after credential rotation: preserving evidence, auditing persistence, the wipe-vs-clean decision, rebuilding clean, and hardening so it cannot sit silently again. If AV already flagged something, read why quarantine alone isn't enough before you trust a clean report.