How to Check a Mac for Infostealer Signs

Start with the boundary, because it governs everything below: no check on this page, and no product anywhere, can prove a Mac is clean. What you can do is look at the specific places this class of malware has to touch, and treat "I found nothing" as unresolved rather than safe.

That sounds like a caveat. It is actually the useful part — because it tells you where to spend your effort, and it is not on the Mac.

Can you tell whether a Mac has an infostealer?

Partly, and it is worth doing. Infostealer-class malware makes trade-offs you can look for. To survive a restart it usually needs a login item or a launch agent. To collect what it wants it has to read browser profiles and keychain-adjacent files. To deliver anything it has to open an outbound connection. Each of those leaves something you can inspect.

But a stealer that ran once, took what it wanted, and removed itself may leave almost nothing on disk. And its actual product — your sessions and tokens — is now in someone else's browser, where no local check can see it. That is why the last step in this page is not on your Mac at all: it is your accounts' own session lists.

Signs worth taking seriously

Strong signals, roughly in order:

You were told to paste a command into Terminal to fix something — by a website, a video, a support chat, a DM, or a captcha-looking page. This is now among the most common delivery methods in the category.
You installed a "fix", updater, driver or cracked app from a search advertisement, a DM, or a link in a job or freelance conversation.
An administrator password prompt appeared that you did not initiate.
Account security emails about a sign-in, a new device, or a changed recovery address that was not you.
A browser extension, login item or configuration profile you do not recognise.
A device you do not own in an account's active-sessions list.

Weak signals, on their own: a slow Mac, fan noise, a browser crash, a pop-up on a sketchy website. They are worth a look; they are not evidence.

How to check a Mac for infostealer signs, step by step

All of these are read-only. Nothing here deletes, quarantines or changes settings. Paths checked against macOS 26 (Tahoe) on 2026-08-11.

Login items. Open System Settings > General > Login Items & Extensions and read both lists: Open at Login and App Background Activity. The second is the interesting one — it is where background helpers appear, and most people have never opened it. Scroll further for the extension categories (network extensions, endpoint security extensions, file providers) and read those too.
Launch agents and daemons. These are the folders third-party software uses to start itself:
```
ls -la /Library/LaunchAgents /Library/LaunchDaemons ~/Library/LaunchAgents
```
Finding things here is normal. On the Mac used to write this page the list included Little Snitch, Backblaze, a security agent and two app updaters — all expected. The test is whether you can explain each one, not whether the folder is empty. Apple's own services are not in these folders; they live under /System.
What a launch item actually runs. Names are trivially faked, so read the target rather than the label:
```
defaults read /Library/LaunchAgents/<name>.plist
```
Look at Program or ProgramArguments. A path inside a normal application bundle is unremarkable. A path in your home folder, a hidden directory, /tmp, or a random string of characters is worth stopping on.
Where a running service lives. For any label you want to resolve:
```
launchctl print gui/$(id -u)/com.apple.accountsd
```
This prints the path of the plist that defined it and the program it actually executes — the two facts that are hard to fake. Apple's real com.apple.accountsd, for example, resolves to a program inside /System/Library/Frameworks/; see what com.apple.accountsd is for the full worked example of separating a real Apple service from something borrowing its name.
Configuration profiles. System Settings > General > Device Management only appears if a profile is installed. On a personal Mac that you did not enrol in anything, its presence is a question worth answering.
Browser extensions and profiles. Check every browser and every profile, not just the one you use most. Look for extensions you did not add, and for profiles you did not create.
Account session lists. The highest-value check on this page, and the only one that looks at what actually gets taken. In your email, Apple Account, cloud storage, and any platform that matters: open the security or devices page and read the list of active sessions, signed-in devices, and connected third-party apps. Anything you cannot account for is a much stronger finding than anything on your disk.

The free open-source Mac check

There is a free, open-source Mac check that automates a subset of the disk-side steps: hardenmac-scan. We call it a check rather than a scanner deliberately, because "scanner" implies a verdict it cannot give.

What it is: a short shell script, read-only, no sudo, no network calls, no telemetry, and it does not remove or "clean" anything — automatic removal is how evidence disappears. What it is not, in the repository's own words: it "cannot identify a malware family, prove a Mac is infected, or prove a Mac is clean."

Download it and read it before you run it. The README says the same thing more bluntly: do not pipe it from the internet into a shell. That instruction is not housekeeping — being talked into pasting a command you have not read is the exact delivery method this entire page exists because of. A tool in this space that asks you to break that rule has told you something about itself.

What a clean result means

It means none of the indicators that version checks were found. It narrows uncertainty. It does not certify anything, and it does not convert "unknown" into "safe".

This applies to commercial antivirus results too. A clean scan is a data point from a tool that recognises what it has seen before, on a category of malware that is rebuilt continuously and often deletes itself after a single run.

If something looked wrong

Stop using that Mac for anything involving accounts and move to a different device.
Work the free First-Response Checklist — contain, then sign out other sessions, revoke connected apps, then rotate credentials in order of control.
Then deal with the machine: removing AMOS-class malware and why removal isn't recovery.
When it is over, close the gaps: the Mac Security Checklist.

If you want to know how much would be at stake before deciding how hard to work, the free Mac Exposure Check answers that in a few minutes, entirely inside your browser tab. The paid HardenMac Safety & Recovery Protocol is the long-form version with the full decision trees — out now for $29 (founder’s price) via the front page.

Common questions

Will antivirus detect an infostealer on a Mac?

Sometimes, for samples it recognises. Treat a detection as useful information and a clean result as inconclusive. Variants in this category are produced faster than signatures for them, and some samples remove themselves after one run.

How do I know if my Mac has a virus?

You look at the places software has to touch to persist and to collect — login items, launch agents, profiles, extensions — and you look at your accounts for sessions and devices you cannot explain. You do not get a yes/no. You get a stronger or weaker case.

What do Mac infostealers actually take?

Typically: browser-stored passwords and card details, cookies and session data, keychain material, notes and documents, cryptocurrency wallet files, and developer keys, tokens and .env files. Assume anything the Mac could read was reachable.

Will a factory reset remove it?

An erase and clean reinstall removes what is on the disk — provided you do not restore machine state afterwards, which is the usual way it comes back. It does nothing about sessions and tokens already copied elsewhere. Those need revoking, not erasing.

My scan came back clean. Am I fine?

You are less worried, with reason, and you have not proven anything. If a strong signal from the list above applies to you, work the account side anyway. Signing out other sessions and reviewing connected apps costs an hour and cannot make things worse.

Should I just take it to an Apple Store?

They can help with hardware and with a clean reinstall. They are not going to audit your account sessions or your connected apps, and that is where the loss actually happens.

Sources

Apple — Change Login Items & Extensions settings (macOS Tahoe 26); the Open at Login and App Background Activity section names.
Apple — Protect your Mac from malware (macOS Tahoe 26).
hardenmac-scan — the free, open-source, read-only Mac check; quoted boundary statements are the repository's own.
All Terminal commands on this page were run on macOS 26.6.1 (build 25G76) on 2026-08-11.

HardenMac is experience-based guidance, not professional advice, and not antivirus or incident response. It does not scan this Mac, its accounts, files or network, and it cannot detect or rule out a problem. Menu names vary by macOS version; if a setting has moved, search for its name inside System Settings.