Macs may be a far less tempting target for malware and viruses, but they’re not immune from attack. Even if you don’t care about adware or being used as means to infect users on other platforms, it’s still possible to fall victim to ransomware, or password theft.

Accordingly, good antivirus for Mac software will protect your Mac on all of these fronts. It’ll catch malware that’s still spreading or in circulation; block ransomware; protect older systems with out-of-date software from security vulnerabilities; prevent your Mac from acting as a carrier for malware aimed at other operating systems; and keep infected files off of any virtual machines you’re running.

As to the question of which Mac antivirus software you should choose, our current top pick is Intego Mac Internet Security. However, you will find several other recommendations below that may suit you better, depending upon the type and number of devices that need protection and also how much you want to pay.

Our top contenders in our best Mac antivirus round up dominate by posting perfect (or virtually near perfect) scores from security research labs, passing our own malware detection tests with flying colors, offering well-designed interfaces, and even throwing in extra features like a firewall or password manager.

For some great discounts and deals see our best Mac antivirus deals round up.

Updated May 5, 2023 to update the F-Secure review.

Best antivirus for Mac reviews

Best Mac antivirus at a glance comparison

Here is an overview of the top Mac antivirus software tested above.

Developer

Product name

USB scan

Ransomware protection

Adware prevention

Anti phishing  protection

Email protection

Firewall

VPN

iOS version

Parental Controls

Support

Trial

Price

Intego

Internet Security X9

Y

Y

X

Y

X

Y

X

Y

Y

Y

7 days

$49.99/£49.99 / ye ($24.99/£20.99 /yr deal)

Clario

Antivirus 1.5 for Mac

Y

Y

Y

Y

X

X

Y

Y

X

Y

7 days

£107.88/£107.88 / ye (currently $50/£50 /ye); ($4.17/£4.17 / mo for a year, or $8.99/£8.99 /mo billed monthly)

AVG

AntiVirus for Mac

X

X

X

X

Y

X

X

Y

X

X

60 days

Free (Paid for version is $2.49 per month for one year / $2.39 a month for two-years / $2.29 a month for three-years)

Norton

360 Deluxe

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

30 days

$39.99/£34.99/yr

McAfee

Total Protection

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

30 days

$34.99/£34.99/yr

Avast

Premium Security

Y

Y

X

Y

Y

Y

Y

Y

X

Y

60 days

$44.99/£39.99/yr

Bitdefender

Total Security

Y

Y

X

Y

Y

Y

Y

Y

Y

Y

30 days

$39.97/£34.99/yr

Eset

Cyber Security Pro

Y

Y

X

Y

Y

Y

X

X

Y

Y

30 days

$49.95/£39.95/yr

Trend Micro

Antivirus for Mac

X

Y

Y

Y

Y

Y

Y

Y

Y

Y

30 days

$39.99/£49.95

Avira

Prime

Y

Y

Y

Y

X

Y

Y

Y

Y

Y

30 days

$99.99/£85.99

Do Macs need Mac antivirus software?

Plenty of Mac aficionados will tell you that Apple computers are inherently secure and don’t require protection. We’d argue that they are wrong – or overconfident, at the very least.

Not long ago, the Silver Sparrow malware was detected on Macs powered by the M1 processor and infected hundreds of thousands of Macs in total. The bad guys, then, are still very much targeting Mac users and they’re getting smarter and greedier. As a result, cyber security is something you can’t afford to ignore, and good Mac antivirus is a very good place to start if you want to stay safe.

Macs are generally more secure than their Windows brethren for two reasons. On the technical side, macOS is a Unix-based operating system. As a Unix-based operating system macOS is sandboxed.

Sandboxing is like having a series of fire doors: even if malware gains access to your Mac, it is unable to spread to other areas of the machine. They are more difficult to exploit than Windows PCs, but Macs are not unhackable.

More general advice can be found in our Mac security tips; and those who have been hit by a malware attack should try how to remove a virus from a Mac.

How to choose the best Mac antivirus

Features fundamental to all packages are two ways to find viruses: on-demand protection and via always-on protection. The former finds viruses by examining one file after another during scheduled scans, or when you choose to undertake a scan, perhaps because you’re worried your Mac might be infected. The speed at which the Mac antivirus app can do this is important, because some take a long time and also hog the Mac’s CPU while they do so. Waiting six hours to find out if your Mac is infected is neither convenient nor relaxing.

Always-on malware protection is what protects the user outside of the times when scans are run. If some malware arrives, perhaps via an email or a downloaded file, then the always-on protection should be able to detect it and either quarantine it (copy it to a safe folder so the user can decide what to do with it), or simply delete it. Usually a notification is shown when malware is detected in this way, but not all antimalware apps show the same amount of explanation of what’s happened – and this was one of the factors we examined in our testing.

Outside of direct malware detection, many security suites include additional tools such as ransomware protection. Ransomware is a type of malware that, once it’s infected a computer, encrypts all the user’s files and then demands a fee to decrypt them. To protect against this infection, anti-ransomware features typically block any app from writing to a user’s home folders, such as Documents or Photos, unless the app’s pre-approved (a process called whitelisting). Lots of apps come already pre-approved, of course, such as Microsoft Word, or Apple’s own Photos app. But you can add others.

Several products also include virtual private network (
VPN) add-ons. These protect an internet connection by encrypting it, and this is useful when utilising unsafe open WiFi such as that provided by a café or hotel. In our experience, these are not replacements for separate paid-for VPN services as many do not unblock video streaming services and some are cut-down versions which constantly nag you to pay extra for the full, premium versions.

Web protection via browser plugins or extensions is also a common component and aims to stop you (or your children) doing anything you regret online, such as visiting fake or infected websites or handing over personal information.

There are usually different options from each vendor, and you get more extras with the top packages, and far fewer with free ones. They might include password managers, parental controls, cloud storage – the list goes on. Generally, the underlying antimalware engine is the same in all products from the same company, so you can save money if you don’t need those additional features.

Do bear in mind that all antivirus for Mac apps are sold as yearly subscriptions. That’s right, you can’t just pay once and use forever. Often there’s a hefty discount for that first year’s subscription, but this can burn you when automatic renewal occurs a year later and the full retail price is charged: often 100% more. Alternatively, you can purchase several years’ subscriptions at once for a bigger discount.

Some of the best Mac antivirus subscriptions allow you to install the software on more than one computer (including Windows and Android devices), which can sometimes add significantly to the value – all computers, phones and tablets within a household can be protected with one subscription.

Spotting fake Mac antivirus software

Beware that, due to the fact that people are so concerned about malware threats on the Mac, there have been cases of malware disguising itself as an antivirus app, such as the Mac Auto Fixer pop-ups that appeared on some Macs suggesting that software needs to be installed (at a high price). This is similar to another fake antivirus app called MacDefender.

Another Mac antivirus company that is often thought of as unscrupulous is MacKeeper. In the past various reports have suggested it is a scam or at worst malware. In recent times MacKeeper has attempted to transform itself and leave its disreputability behind. It has, for example, gained Apple Notarization – which means the software is checked by Apple for malicious components. The company has also been working to get certifications from various bodies to prove it isn’t a PUP, including an AV-Test certificate. If you have any problems with MacKeeper we do explain how to remove it here: How to uninstall MacKeeper.

How we test Mac antivirus software

Each software package is evaluated creating a clean installation of macOS, cloning it for each AV product, and then booting separately into each one to install a different package. This was to ensure that previous app installations didn’t interfere with new ones – sometimes AV software treats other AV software as an infection.

In addition to visiting malicious websites, downloading known malicious software, and even running said malware on our Mac, we also reference the most recent reports from two labs that regularly cover macOS malware: AV Comparatives and AV-TEST. These laboratories test AV software against sets of known malware as well as products that are grouped as potentially unwanted applications (like adware).

The latter doesn’t damage or expose your computer or its files but may consume power and CPU cycles. Because the testing effectively looks at a combination of virus databases and behavior, they remain good gauges even after many months. When an antivirus for Mac software package lacks a rating from a known security research lab, we do more extensive testing with real malware.

Finally, while we gave props for a lot of different features and behaviors, we marked products down if they lacked any or all of the following:

• A nearly perfect score on macOS malware detection
• Ransomware monitoring
• Native browser plug-in or system-level Web proxy
• A high score on Windows malware detection

Privacy concerns

Using a Mac antivirus product, especially any that includes tools to also improve your online privacy, may lull you into believing you’re safe from personal and private information leaking out. That’s not quite the case. While there’s no reason to panic, you should consider a few reasonable issues.

First, an antivirus for Mac product may upload the complete text of files flagged to the cloud, where it can be analyzed by separate tools hosted there. This practice is normal and sensible: Some malware can detect when a running process may examine it, and will then engage in subterfuge. Antivirus software makers also can access their massive databases to examine files with characteristics that trigger their algorithms—certain elements that match known malware. As a result, security researchers discover new viruses, worms, Trojans horses, and the like.

However, helping the greater good means you’ll have to be comfortable with trusting a third-party with your file contents. Where appropriate, we noted privacy policy issues in individual reviews.

Second, this software may also rely partly or entirely on cloud-based checks of URLs, malware, and the like. Accordingly, an AV package might upload every URL you visit, metadata about files, signatures of files, information about your computer’s hardware, a list of running or installed applications, and more. Companies vary on their disclosure of such policies, and may not let you opt out of this kind of sharing. We note issues in each review as available.

Third, anti-virus software makers also get a sense of what behavior is happening on your computer that’s being monitored or blocked, and may use that information for their own purposes. In some cases, you can opt out of this information gathering.

Antivirus, Personal Software, Security

The AirTag from Apple is a compact tracking device that has an extremely long life and precise locating ability in the right circumstances. Unlike a GPS tracker, which requires cell service and may drain a battery quickly, an AirTag relies on the distributed Find My network of iPhones, iPads, and Macs that hundreds of millions of people around the world carry with them, and uses Bluetooth LE to signal that hardware.

While there are a thousand positive and legitimate ways to use an AirTag, it can be abused when someone tracks you without your knowledge, which potentially exposes you to a dangerous situation. For example, back in December 2021, the York regional police department in Canada announced that AirTags were being placed in hidden areas of target cars parked in public, and then tracked to the driver’s residence, where the cars are stolen while parked in the driveway. In another incident, a woman claimed that she found an AirTag hidden in her wheel well after her iPhone alerted her to an AirTag moving with her. State governments in New York and Pennsylvania have issued warnings about the misuse of AirTags and similar tracking devices.

Incidents like this are rare (at the time, York police said there had been five AirTag-involved thefts out of 2,000 in the region). Apple has put some safeguards in place so that an iPhone, iPad, and AirTag provide varying alerts and information if the owner who paired the AirTag with their iPhone or iPad isn’t nearby. There are tools built into the iPhone to find and disable AirTags as well as an Android app that will scan for AirTags nearby.

In May 2023, Apple and Google announced a joint initiative to allow Bluetooth location-tracking devices to be compatible with unauthorized tracking detection and alerts across iOS and Android platforms. A production implementation of the specification for unwanted tracking alerts is targeted for release by the end of 2023 for future versions of iOS and Android.

You probably know already if you’re a candidate for involuntary tracking: someone in your life (or formerly so) or a family member may show up at unexpected times in unexpected places when they have no reason to know you’re there. They may comment in person, via email, or otherwise about your activities or whereabouts. Or you’re in the middle of or long past a nasty break-up of a relationship or marriage or have broken off contact with a parent or family members.

Whatever the case, if you’re in need of help, consult the National Domestic Violence Hotline or more specialized resources for victims of domestic abuse, stalking, and other violence listed by the National Coalition Against Domestic Violence. Local law enforcement, the FBI, or national police in other countries also offer resources.

How an AirTag can track you

Because AirTags don’t register proximity except to the owner, the only way it can be used to gather information about you is if it travels with you. An AirTag in your home, office, or classroom won’t reveal anything to someone trying to keep tabs. That reduces the “surface area” of unwanted surveillance because the AirTag has to be in your clothes, wallet, or purse, something else you’re carrying, or in a vehicle you’re in and using exclusively or at least regularly.

If you’re traveling regularly through urban and suburban areas or on public transportation, other people’s devices will still pick up and relay location information about any AirTag that’s with you. That can include something as innocuous as pulling over to a rest area on a highway, and someone 50 feet away has an iPhone, or even driving on a highway near other people who have iPhones or iPads connected to a cellular network.

Bluetooth LE’s range is surprisingly long. I found that an AirTag I temporarily placed in my car, parked two flights of stairs down from our ground floor and about 50 feet from the house still provided regular updates about its location via devices I owned—not to mention those of neighbors walking or driving by.

Everyone’s devices participate in relaying secured, privacy-protecting location information about their devices and AirTags unless they opt out of the Find My network. That makes everyone around you a potential participant in tracking you via an AirTag you don’t know about.

Once the AirTag is in your possession it will relay its location to the owner via the Find My network and other Bluetooth devices.

How to know you are being tracked by an AirTag

Apple issues alerts to let someone know that there’s an AirTag near them that isn’t associated with their iCloud account. These alerts happen after some period of time or while you’re moving and the AirTag is moving with you.

Should an unknown AirTag be tracking you you will see an alert that will state: “AirTag Found Moving With You”. Apple will invite you to open the Find My app on your iPhone to go through various options to disable the tracking and locate the AirTag, discussed below. (Incidentally, you may also see an alert for other devices moving with you, such as AirPods and other Bluetooth trackers).

Apple recognizes that it could be an innocent case of having borrowed an item from someone with an AirTag attached or inside it, so one of the options is to Pause Tracking Notifications.

To make sure you will receive an alert like this follow these steps:

You will need to have an iPhone or iPad running iOS/iPadOS 14.5 or later.

1. Open the Find My app.
2. Tap the Me tab.
3. Tap Customise Tracking Notifications.
4. Make sure the Allow Notifications slider is green (it should be by default).

Via the alert, you can see how long this AirTag has been with you. You can also see a map of the locations where the AirTag has been tracked in your possession, which may give you an indication of where you picked it up.

How to find an AirTag that’s tracking you

Luckily Apple makes it easy to locate the AirTag that is tracking you. Here’s what to do if you have seen a warning from Apple that an AirTag is following.

One option is to use Apple’s Find My app to manually scan for AirTags near you using the Items That Can Track Me option in the Items tab.

If you have an Android phone, you can also check for unknown AirTags moving with you using the Tracker Detect app. It’s far less robust than Apple’s Find My app and needs to be run manually.

1. Play a sound to locate the AirTag

You may find that the tracking AirTag will play a sound once it has been separated from its owner for a time and then moves.

This happens after what Apple calls an “extended period of time” away from its paired iPhone or iPad (the company has disclosed elsewhere that this is three days). After this period, an AirTag makes a beep whenever it’s moved. If you hear an unexpected beep from something you’re carrying or within your vehicle, then it’s time to engage in the hunt for an AirTag.

The audio alert winds up being less useful than one might hope. If a stalker or other person engaged in surveillance can come within range of the AirTag at least every three days, and they know you don’t have an iPhone or iPad that’s running 14.5 or later, they can reset that counter. The beep that’s made isn’t ongoing or particularly loud, and it can be muffled without blocking the Bluetooth signal substantially.

If you haven’t heard a beep, or want to hear it again, you can force the AirTag to play a sound.

If you have received an alert about an AirTag that is traveling with you and want it to make a sound follow these steps:

1. Tap Apple’s Alert.
2. Tap Continue.
3. Tap Play Sound.

You will have the option to play the sound again.

You may find that there is no option to play a sound, in that case, the item may no longer be near you or it may be back in range of its owner,.

Another reason why you may not be able to find the AirTag is that it may have changed its identifier (which happens regularly). The Bluetooth ID produced by an AirTag, and by all Apple devices that participate in Find My crowdsourcing, changes on a regular basis to avoid becoming a reverse tracking item: if it were persistent, then someone could track your devices based on the “anonymous” Bluetooth ID. That means that your iPhone or iPad has to notice an AirTag moving with it over a relatively short period of time.

Another possibility is that the AirTag speaker has been disabled. After reports of people disabling AirTag speakers, Apple announced that it would add a notification along with the sound on an iPhone, iPad, or iPod touch it is moving with. Apple also says it will adjust the tone sequence that plays when a user has an unknown AirTag traveling with them to make an unknown AirTag easier to find. In a 2022 firmware update version 1.0.301, Apple tweaked the unwanted tracking sound to “more easily locate an unknown AirTag.”

If you own the AirTag it is easy to locate it using the Find My app on an iPhone or iPad to play an audible sound on the AirTag. As part of macOS 13.1, this feature also came to the Find My app on Macs.

2. Use Precision Finding to find the AirTag

As well as the option to play a sound the alert will also give you the option to use Precision Finding if that is available on your device. Your iPhone would need to support Ultra Wideband via the U1 chip to precisely locate an AirTag, which includes iPhone 11 and later.

If Apple’s Alert gives you the option for directions tap Go and you should see directional arrows pointing you in the right direction and a guide to the distance between you and the device. This should help you locate it.

3. Search for the AirTag

If you didn’t manage to get it to make a sound and Precision Finding wasn’t the answer for you you will need to look for the AirTag.

The first step is to get familiar with what it looks like. If you haven’t seen an AirTag before, consult Apple’s site. They have a rounded white top and a silver base, are somewhat larger than an American quarter or a dollar/pound/single unit coin in many countries, and about three to four times thicker.

As we mentioned earlier, the AirTag has to be moving with you for Apple to have sent the alert, so look inside things that you have with you when you move around:

• Check pockets: In clothing, not just pockets but also check inside the lining or anywhere it could have been sewn in.
• Check bags: Look inside purses, luggage, messenger bags, and other items, unzip and also feel for an AirTag that’s been placed or sewn in.
• Check belongings: Someone could have posted you an item with an AirTag in it.
• Examine your car: A car may have a number of locations that are unreachable or hard to check. Because an AirTag has as long as a year’s worth of power, someone might wrap it in cotton (to stifle the beep it may make; see below), slit a fabric seam, slip it in, and sew it back up. Parking your car away from homes and businesses and using a Bluetooth scanner can help you pinpoint if one is in your car.

Even if someone doesn’t have access to your home, work, school, or vehicle, and you don’t receive mail at the address at which you live—you might use a P.O. box or another person’s address—someone could ship you an item with an AirTag in it, and when you take that home, they could have your location. If you’re in that specific situation, you may need to examine all packages received elsewhere before bringing them home.

4. Find the AirTag using a Bluetooth scanner

Because AirTag regularly emits Bluetooth signals that Apple devices can pick up, you can use a simple Bluetooth tracker for iOS or iPadOS to scan the area around you and see if an AirTag is nearby. While these tracking apps can’t identify AirTag as such—AirTag changes its Bluetooth ID regularly to avoid being trackable themselves—the apps give you the lay of the landscape. That includes the names of Bluetooth devices that do label themselves in their broadcasts.

BLE Scanner is a limited but free app that provides a list of Bluetooth devices your iPhone or iPad can detect, and offers a mapping feature that roughly sorts them by signal strength into distance away. This is particularly useful if you’re checking out whether a car has a hidden AirTag; less so inside when there may be dozens of your own and neighbors’ devices close enough to register. Regular Bluetooth devices typically identify themselves generically (like my “HP OfficeJet Pro 9010 series” printer) or specifically, as with the sharing name of your Macs, iPhones, iPads, Apple TVs, FitBit trackers, and so on.

Bluetooth BLE Device Finder (free to download, but $4.99 to unlock needed features) has the advantage of letting you drill down into Bluetooth technical details, which may give additional clues about which devices are legitimate and not.

If you can eliminate all known Bluetooth devices, including by powering down equipment that you’re unsure of, and what’s left has no associated name, it can be worth looking further by hand.

How to stop an AirTag tracking you

There are a number of ways you can stop the AirTag from tracking you. We’ll run through them all below.

1. Opt out of the Find My network

While you can’t stop other iPhone, iPad, and Mac users from relaying the location of the AirTag, you can at least opt yourself out of the Find My network, though this removes your ability to track your own lost or stolen iPhone, iPad, Apple Watch, Mac, or an AirTag through this extended network. Earlier versions of iOS and macOS don’t include support for the Find My network.

• In iOS 13 or iPadOS 14 or later go to Settings > Account name > Find My > Find My iPhone/iPad, and disable Find My network.
• In macOS 10.15 Catalina or later, go to the Apple ID preference pane, select the iCloud link at left, click the Options button to the right of the Find My Mac item, and uncheck Offline Finding or Find My network (the text varies by macOS version).

2. Get the AirTag’s serial number and associated phone number

If you find an AirTag, you can safely determine more information about it without disclosing to the person who planted it that you’ve done so. The AirTag includes NFC, useful both for pairing the device initially and for letting any smartphone or tablet with an NFC reader pull up a URL from the device. That includes Android phones and other hardware, as it uses an industry standard for NFC encoding. On following the URL, you’re taken to a page that contains the AirTag’s serial number. That page can also show a phone number set by the owner if they marked it lost. The owner isn’t notified in any fashion about the page being loaded, and Apple preserves the owner’s privacy by providing no direct linkage at all.

However, in the case of unwanted tracking, the serial number may help if you pursue civil action, want to obtain a restraining order, or contact law enforcement. Because AirTag tracking requires device pairing, an iCloud account, and an iPhone or iPad that’s logged into the account, anyone actively tracking you is also producing a trail of information stored on their phone, across the cellular network, and in other places.

Apple uses end-to-end encryption to protect the location information sent from an arbitrary device to an iPhone, iPad, or Mac, which has to use the Find My app to view it. But the information isn’t secured in the same way on the device. Police and national investigators would be able to create a close association of logins and access, as well as prove that an AirTag was paired with a specific iPhone or iPad. This may deter abusers and others somewhat if they’re aware of how easily they can be tracked back.

3. Disable the AirTag

Once you’ve found the AirTag and obtained the information you want from it, you don’t need a hammer or rock to disable it. Unlike most of Apple’s hardware, the AirTag has a removable battery.

• Use pressure to rotate the AirTag’s metal underside counter-clockwise (from upper right to upper left).
• Remove that plate.
• Then remove the battery.

Mobile Phone Accessories