On macOS, apps can install themselves in three places: the Applications folder, the user ~/Library folders, and as LaunchAgents that run silently in the background. A proper audit checks all three.
Step 1: Sort Applications by Date Added
- Open Finder → Applications
- Click the icon view in the toolbar, then choose View → as List
- Click Date Added column to sort newest first
- Anything in the last 30 days that you do not remember installing is worth investigating
Step 2: Login Items & background apps
- System Settings → General → Login Items & Extensions
- Review every entry under Open at Login and Allow in the Background
Step 3: Check hidden Library folders
Open Finder, press ⌘ ⇧ G and paste each path:
~/Library/LaunchAgents/Library/LaunchAgents/Library/LaunchDaemons~/Library/Application Support
Sort by Date Modified. Anything recent and unfamiliar — especially with random strings or names you cannot find online — is a strong candidate for malware persistence.
Was this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers