How to Tell If a Slow Mac Is Caused by Malware

A sudden, unexplained slowdown on a Mac is one of the clearest red flags. Cryptominers, adware and stalkerware often hide in the background and burn CPU and disk — and they almost always leave traces in Activity Monitor or Login Items.

Symptoms worth investigating

Fans spin loudly even when you are not doing anything heavy
Spinning beach ball appears constantly when launching apps
Battery drains noticeably faster than a week ago
Safari or Chrome takes 10+ seconds to open a new tab
Internet feels slow only on this Mac

Step 1: Open Activity Monitor and sort by CPU

Press ⌘ Space, type Activity Monitor, hit Enter
Click the CPU tab → click % CPU column header to sort highest first
Watch for 30–60 seconds. Anything sitting above 20% with no clear reason is suspect
Right-click a suspicious process → Open Files and Ports to see where it lives on disk

Important

Mac malware often impersonates Apple processes. Names like kernel_task and WindowServer are normal. Names like UpdateAgent, mshelper, xmrig, or anything in /Users/Shared are not.

Step 2: Audit Login Items and Background tasks

System Settings → General → Login Items & Extensions
Review Open at Login — remove anything you do not recognise
Scroll down to Allow in the Background — this is where adware hides; toggle off anything unfamiliar

Step 3: Check disk and network usage

In Activity Monitor, click the Disk tab and sort by Bytes Written — a process writing gigabytes when idle is highly suspicious
Click the Network tab — a process sending data with no app open is a red flag

Tags:

Device Audit & Cleanup

Mac Security

Malware & Viruses

Was this guide helpful?

Know someone who needs this? Send them the guide.

Written by

Jordan Dickson

Founder, CyberSecurityGuides

Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.

Reviewed by CSG Security Engineers