Mac Security & LaunchAgents: How to Check If Your Mac Has Malware

macOS is a well-secured operating system, but that security depends heavily on the assumption that software running on your Mac was intentionally installed by you. The reality is that adware, spyware, and outright malware routinely find their way onto Macs — and once installed, they go to considerable lengths to stay there. The mechanism they rely on is the same one Apple provides for legitimate background software: LaunchAgents and LaunchDaemons.

Understanding how these persistence mechanisms work is the single most effective thing you can do to assess whether your Mac is clean. This guide explains how macOS malware persists, what the common persistence paths look like, and how to tell a legitimate LaunchAgent from a suspicious one. TrimyMac's Security Scan lists LaunchAgents and LaunchDaemons for you to review; it does not judge whether they are safe.

How macOS Malware Persists After Reboot

Most malware has one primary goal beyond its payload: survive a reboot. A malicious process that dies when you log out is far less dangerous than one that reliably restarts itself every time macOS loads. macOS provides several legitimate mechanisms for launching background processes automatically, and malware exploits all of them.

The Most Common Persistence Paths Malware Uses

When security researchers analyze macOS malware samples, a handful of paths appear again and again. Knowing these by heart lets you do a targeted manual check in minutes. The table below shows the most frequently abused locations, ranked by prevalence in real malware samples:

The per-user LaunchAgents folder is by far the most commonly abused because it requires no elevated privileges. A malicious installer, a malicious DMG you mounted, or even a malicious browser extension can drop a plist file there without ever asking for your password.

What a Legitimate LaunchAgent Looks Like

Before you start removing plist files, it is important to understand what a legitimate LaunchAgent looks like. Many real, useful applications use LaunchAgents — Dropbox, 1Password, software updaters, and developer tools all rely on them. Deleting the wrong plist file can break real software.

Anatomy of a Legitimate LaunchAgent Plist

A well-written LaunchAgent from a legitimate app has several identifiable characteristics:

Reverse domain name label: The plist filename and its Label key follow Apple's recommended reverse domain name notation — for example, com.dropbox.DropboxMacUpdate.agent.plist or com.1password.1password-helper.plist. This naming convention mirrors the Bundle ID of the parent application and makes it immediately clear which app owns the agent.

Signed binary: The ProgramArguments key in the plist points to an executable that is code-signed by a verified Apple Developer certificate. You can verify this yourself by running codesign -dv --verbose=2 /path/to/binary in Terminal. A signed binary shows a team identifier like TeamIdentifier=AB12CD34EF.

Sensible program path: The binary the LaunchAgent launches lives in a sensible, permanent location — typically inside the application bundle itself (e.g., /Applications/Dropbox.app/Contents/MacOS/) or in /Library/Application Support/VendorName/. The path is predictable, readable, and directly associated with software you remember installing.

Reasonable keys: Legitimate LaunchAgents use standard keys: RunAtLoad set to true, a Label matching the filename, and clean ProgramArguments. They do not use obfuscated base64 arguments, shell pipes, or inline scripts in the arguments array.

Red Flags: Signs of a Suspicious or Malicious LaunchAgent

Malicious LaunchAgents tend to have a very different fingerprint from legitimate ones. Here are the most reliable warning signs:

Points to /tmp or a Temporary Path

Any LaunchAgent whose ProgramArguments points to a binary inside /tmp/, /var/folders/, or any other temporary directory is an immediate red flag. Legitimate software never stores its executables in temporary directories. Malware uses /tmp because it is world-writable and because the binary can be replaced or updated without any privilege escalation. If you see a path like /tmp/update_helper or /var/folders/xy/randomstring/T/launcher, treat it as malicious until proven otherwise.

Random UUID or Meaningless Name

Malware frequently generates random filenames to avoid detection by name-based signature tools. A plist named com.apple.mdworker.bkd.plist that is not inside /System/Library/ is suspicious (malware often mimics Apple's own naming patterns). A plist named something like 4f8a2c1b-9e3d-47f2-b6a0-2d1e9f3c8741.plist or com.update.service.helper.plist with no clear association to any installed application is almost certainly malicious.

Unsigned or Revoked Binary

Running codesign --verify --verbose /path/to/binary on the binary pointed to by a suspicious LaunchAgent will tell you immediately whether it is signed. If the output is code object is not signed at all or shows a revoked certificate, that is a serious red flag. Most legitimate background processes on a modern Mac are signed and notarized.

Shell Script as the Program

A LaunchAgent that launches /bin/sh or /bin/bash with a script as its argument — especially if the script is stored in a hidden directory, uses obfuscated variable names, or downloads content from the internet — is almost certainly malicious. Legitimate apps use compiled binaries for their background helpers, not shell scripts.

Unusual Keys or Encoded Payloads

Look for the presence of unusual plist keys such as EnvironmentVariables with encoded strings, StartInterval set to a very short interval like 30 seconds (suggesting polling for commands), or WatchPaths that monitor sensitive locations like your Downloads folder or Desktop.

TrimyMac Security Scan

Security Scan does not check code signatures, Login Items, or cron, and it does not decide that a file is safe or malicious. It lists files for you to review.

Run a storage scan first. AppModel.runSecurityScan in Sources/SpaceGuard/AppModel.swift passes that scan's file list to SecurityScanner.scan in Sources/SpaceGuard/Security.swift, with a new MalwareSignatureDatabase(). The signature database is empty: its hash list starts empty, so the hash check is skipped. The scanner then keeps every file that is not a directory and whose path contains /Library/LaunchAgents/ or /Library/LaunchDaemons/. Those checks cover three folders when the storage scan included them: ~/Library/LaunchAgents, /Library/LaunchAgents, and /Library/LaunchDaemons. A storage scan starts in your home folder unless you choose another root (selectedRoot in AppModel.swift), so the usual result is files under ~/Library/LaunchAgents. The two /Library folders appear only when that root included them. FileScanner in Sources/SpaceGuard/FileServices.swift skips /System, so Apple's copies under /System/Library are not listed. Each match is labeled Unknown, with the reason “Persistence location — review recommended.”

What the Security screen shows

1. If you have not scanned storage yet, the Security screen says a storage scan is needed first. Run Security Scan stays disabled until that scan has files.
2. Open Security in the sidebar and click Run Security Scan. The dashboard Security Scan button starts the same scan.
3. Each match is one row: the Unknown label, the reason above, and the file path. There is no detail view for a signature status or a score.
4. A file inside your home folder has Remove. Confirming it calls removeFinding, which moves that one file to the Trash. A file outside your home folder is marked Protected, and the app does not remove it. The app does not unload the job in launchd, and it does not delete a separate program the plist points at.

How to Remove a LaunchAgent You Do Not Want

Security Scan only labels matches Unknown. If you decide a listed file should go, move a home-folder file to the Trash from the Security screen, or remove it yourself in Terminal.

Using TrimyMac

1. Run a storage scan, then open Security and click Run Security Scan.
2. Read the path on the row. Look up anything you do not recognize before you remove it.
3. For a file inside your home folder, click Remove and confirm Move to Trash. That moves only that file. Files outside your home folder are shown as Protected.

Moving a plist to the Trash does not tell launchd to stop a job that is already running. Unload it in Terminal, then restart, if you want it gone immediately.

Manual Removal via Terminal

If you prefer to handle this without TrimyMac, you can remove a LaunchAgent manually. First, unload it from launchd to stop it immediately without waiting for a reboot:

After removing a LaunchDaemon (which requires admin access), use sudo launchctl unload /Library/LaunchDaemons/suspicious.plist and then sudo rm /Library/LaunchDaemons/suspicious.plist. You will be prompted for your administrator password.

After Removing Malware: What to Check Next

Removing a LaunchAgent or LaunchDaemon is a good start, but sophisticated malware often installs multiple persistence mechanisms simultaneously. After removing a confirmed malicious entry, run through this checklist to ensure nothing was missed:

Check the other persistence paths yourself. Security Scan does not read Login Items or cron. Some malware installs a second LaunchAgent that puts the first one back. After you remove one, look again in ~/Library/LaunchAgents, /Library/LaunchAgents, and /Library/LaunchDaemons, then check Login Items and cron as described earlier in this guide.

Check your browser extensions. Many Mac adware infections originate from malicious browser extensions and use a companion LaunchAgent to ensure the extension cannot be permanently removed. After removing the LaunchAgent, go through your browser extensions in Safari (Safari > Settings > Extensions), Chrome (chrome://extensions), and Firefox (about:addons) and remove any you do not recognize.

Check for unauthorized profiles. Configuration profiles installed by malware can redirect DNS, install root certificates, or force-install browser extensions. Go to System Settings > Privacy & Security > Profiles (or System Preferences > Profiles on older macOS). If you see any profile you did not install yourself, remove it.

Change passwords for sensitive accounts. If the malware you removed was a keylogger or credential stealer (common categories of Mac spyware), change passwords for your email, financial accounts, and Apple ID. Enable two-factor authentication on any account that does not already have it.

Summary

macOS is secure by design, but no operating system is immune to software that a user knowingly or unknowingly installs. LaunchAgents and LaunchDaemons are the primary tools that both legitimate applications and malware use to persist across reboots. The difference between the two is usually visible in the details: a reverse domain name label, a signed binary in a predictable path, and sensible plist keys are hallmarks of legitimate software. A UUID-style name, a binary in /tmp, or an unsigned executable are hallmarks of something that should not be there.

Regular inspection of your Mac's persistence paths is the single most effective proactive security measure available to macOS users outside of keeping the OS updated. TrimyMac's Security Scan lists LaunchAgents and LaunchDaemons for you to review; it does not judge whether they are safe.