Do Macs and iPhones need antivirus?

Every Mac ships with several layers of malware protection that run without you doing anything:

• XProtect is Apple's built-in malware scanner. It checks apps when they are first opened and when they change, and Apple updates its detection rules in the background, separately from full macOS updates. Recent versions also scan periodically and remove known malware they find.
• Gatekeeper checks that a downloaded app comes from an identified developer and has not been tampered with before it is allowed to run.
• Notarization means developers who distribute Mac apps outside the App Store submit them to Apple for an automated malware check. Gatekeeper warns you, or blocks the app, if it has not been notarized.
• System Integrity Protection stops even an app with an administrator password from modifying core system files.

On recent versions of macOS, getting past a Gatekeeper warning for an unnotarized app requires a deliberate trip to System Settings > Privacy & Security. Apple made it harder on purpose, because the "open it anyway" step is exactly what malware distributors coach people through.

"Macs don't get viruses" was never quite true, and it has aged badly. Security researchers have tracked a steady rise in Mac malware, most of it aimed at stealing things rather than breaking the computer.

• Information stealers. Malware such as Atomic Stealer (often called AMOS) goes after saved browser passwords, cookies that keep you logged in, keychain data and cryptocurrency wallets. It usually arrives disguised as a popular app, a cracked copy of paid software, or a download promoted through search ads.
• Fake updates. A website tells you your browser or Flash Player (long dead) needs updating and offers a download. Real browser updates come from the browser's own menu, and macOS updates come from System Settings.
• Adware and browser hijackers. Less dangerous, very annoying: they change your search engine, inject ads and track browsing. They often ride along with free utilities from download sites.
• Tricks that ask you to paste a command. Some campaigns show fake "verify you are human" pages that tell you to paste a line into Terminal. Never paste commands into Terminal from a website or message you did not seek out.

Almost all of these need your cooperation: you download the file, approve the warning and type your password. The built-in defenses catch many of them, but a brand-new variant can slip past signature updates for a while.

On an iPhone or iPad, every app lives in its own sandbox and cannot read other apps' files or inspect what they are doing. That rule applies to security apps too. A traditional antivirus that scans your device for malicious software simply cannot work, and Apple does not allow it.

So what do the iPhone apps from security companies do? Mostly a mix of:

• Web protection that blocks known phishing and scam sites, usually through a local VPN profile or a Safari extension.
• Scam text filtering, using iOS's message-filter feature.
• Breach alerts when your email shows up in a leaked database.
• Checks that your iOS version is current.
• A bundled VPN in some plans.

Several of those you can get free. iOS has its own unknown-sender message filtering, Safari warns about fraudulent websites (Settings > Apps > Safari on recent iOS, then Fraudulent Website Warning), and Have I Been Pwned sends breach alerts at no cost.

The genuine iPhone risks are a stolen Apple Account password, a known passcode in the wrong hands, a malicious configuration profile and phishing. Our guide on how to tell if your phone is hacked covers what to check, including Safety Check and Lockdown Mode.

If you just want a second opinion now and then, Malwarebytes has long offered a free Mac scanner that finds and removes adware and malware on demand, with real-time protection in its paid version. Running a scan when something feels off is a reasonable middle ground.

1. Get software from the source. The Mac App Store or the developer's own website, typed in yourself. Scroll past the sponsored search results: malware campaigns buy those ads.
2. Never use cracked apps. A free copy of a paid tool is the classic wrapper for information stealers.
3. Treat password prompts as a decision. When a newly downloaded app asks for your Mac password or asks you to approve something in Privacy & Security, stop and ask why it needs that.
4. Update promptly. Our updates guide shows how to turn on automatic updates for macOS, iOS and your apps.
5. Protect your Apple Account. Use a unique password, keep two-factor authentication on, and add a recovery contact. See two-factor authentication.
6. Use a password manager. Apple's free Passwords app works well inside Apple's world; our password manager guide covers the alternatives.

Signs include a browser homepage or search engine that keeps changing back, new browser extensions you did not add, unfamiliar items in System Settings > General > Login Items & Extensions, and unknown profiles in System Settings > General > Device Management (on some versions, Privacy & Security > Profiles).

Remove the obvious items, update macOS and run a scan with a reputable tool such as Malwarebytes or Bitdefender. If you installed something that asked for your password and you suspect it was a stealer, assume your saved passwords and logged-in sessions are compromised: from another device, change your email, Apple Account and banking passwords, sign out all sessions, and move any cryptocurrency. Our data breach guide walks through the rest.