How to Check for Spyware on Mac in 2026

Quick answer: To check a Mac for spyware, look in System Settings for device-management profiles you didn't install, then at Privacy & Security for apps with Screen Recording, Input Monitoring, Accessibility, camera or mic access. Then check Login Items & Extensions and the LaunchAgents and LaunchDaemons folders for anything you can't explain, and keep macOS up to date.

Below: the checks in order, with the exact settings and Terminal commands, and what to do if you think you're being targeted.

1. Look for configuration profiles and MDM enrollment.
2. Inspect LaunchAgents and LaunchDaemons.
3. Check kernel and system extensions.
4. Review privacy permissions.
5. Look at network connections.
6. Confirm System Integrity Protection is on.

First: Understand What You're Looking For

Spyware on a Mac isn't one thing. It falls into a few categories, and they behave differently.

Commercial monitoring apps (often sold as parental or employee monitoring, and sometimes called stalkerware) are usually installed by someone with access to your Mac and your password. Depending on the permissions they're given, they can log what you type, take screenshots, record audio and send it all to a remote dashboard.

Mercenary spyware, such as NSO Group's Pegasus, is a different level. It has mostly been documented on phones, it can use unpatched flaws to get in without you clicking anything, and it's built to avoid detection. If you might be targeted because of who you are or what you do, the checks in this post aren't enough on their own. See the last sections below.

Unwanted configuration profiles are an underrated route. A profile or a Mobile Device Management (MDM) enrollment can install apps and certificates, change settings and restrictions, and route your traffic through a VPN or proxy. Organizations use them to manage their own Macs, and a profile may allow access to data or location information on the device (Apple Personal Safety User Guide). You might still have one from an old employer.

Check for Configuration Profiles

Start here. It takes a minute.

On macOS 13 or later, go to System Settings > General > Device Management (you may need to scroll down). On macOS 12 or earlier it's System Preferences > Profiles, which only appears if a profile is installed (Apple: review and delete configuration profiles).

If you see profiles listed, read them carefully. A profile from your current employer's IT department is expected. A profile you don't recognize, or one from a company you left years ago, deserves attention.

From Terminal, you can also check:

sudo profiles show -type enrollment

This tells you if your Mac is enrolled in an MDM system. If you see enrollment details on a Mac that isn't managed by a school or company, find out who set it up.

To list installed profiles:

sudo profiles list

To remove a profile you don't want, select it in Device Management and click the Remove (–) button, then restart your Mac. Removing a profile deletes all of its settings, such as an email account or VPN it set up. If you can't remove it, ask the person or organization that provided it. Don't remove profiles from a work Mac without checking with your IT team first: they may need them to manage the Mac.

Inspect Launch Agents and Launch Daemons

LaunchAgents and LaunchDaemons are plist files that tell macOS to run programs automatically, either when you log in (agents) or at startup (daemons). Spyware usually needs one of these, or a login item, to keep running after a restart.

Check these four directories:

ls -la ~/Library/LaunchAgents/
ls -la /Library/LaunchAgents/
ls -la /Library/LaunchDaemons/
ls -la /System/Library/LaunchDaemons/

The first three are where third-party software, including malware, installs these items. The last one is Apple's own and sits on the sealed, read-only system volume, so you shouldn't find anything there that Apple didn't put there.

For each plist file you don't recognize, open it and look at the ProgramArguments key:

cat ~/Library/LaunchAgents/com.suspicious.plist

You're looking for what program it runs and where that program lives. Legitimate software usually points inside an app in /Applications/ or to a helper in /Library/. Spyware often runs from hidden folders, /var/tmp/, or a folder with a nondescript name buried in ~/Library/Application Support/.

Some legitimate software has oddly named LaunchAgents too: updaters, VPN clients and printer drivers among them. Don't delete something just because the name is unfamiliar. Search the identifier first.

Also look at System Settings > General > Login Items & Extensions (Login Items on macOS 13 and 14). Its "Allow in the Background" list shows background items by app or developer name (Apple: open items automatically when you log in).

Check Kernel Extensions and System Extensions

Apple has deprecated third-party kernel extensions (kexts) in favor of system extensions. On a Mac with Apple silicon, a third-party kext can only load after the owner lowers the security setting in Recovery. To list loaded kexts that aren't Apple's:

kmutil showloaded | grep -v com.apple

On most Macs this list is empty or short, perhaps a virtualization tool or a security product. If you see entries you can't identify, look them up. (The older kextstat command still works, but it now just calls kmutil.)

For system extensions, the modern replacement:

systemextensionsctl list

Look for entries from developers you don't recognize. Legitimate system extensions mostly come from security software, VPN clients, network filters and virtualization tools.

Review Privacy Permissions Carefully

Monitoring software needs permissions to work. It needs Screen Recording to take screenshots, Input Monitoring or Accessibility to see what you type, the microphone or camera to record you, and Full Disk Access to read protected data.

Go to System Settings > Privacy & Security and check each of these:

• Screen & System Audio Recording (Screen Recording before macOS 15): which apps can capture your screen. Password fields show as dots, but anything else on screen can be captured.
• Accessibility: lets an app control your Mac and read what's on screen. Monitoring tools often ask for it.
• Full Disk Access: lets an app read data macOS normally protects, such as Mail, Messages and Safari data.
• Input Monitoring: lets an app read what you type in other apps. macOS's Secure Input blocks this in most password fields.
• Camera and Microphone: which apps can use them.

The permission lists are one of the most useful places to look, because most monitoring software can't do its job without these permissions, and macOS keeps the list. A switch that's on means macOS allowed the app, not that the app is using it right now. Our guide to Mac privacy permissions explains each one.

If you see an app with Accessibility or Input Monitoring access that you don't recognize and didn't grant, take it seriously: find out what it is, then turn it off and remove it.

Look at Network Connections

Spyware has to send what it collects somewhere, which means network connections. Open Terminal and run:

sudo lsof -i -P | grep ESTABLISHED

This shows open connections from every process (without sudo, you only see your own). Look for processes you don't recognize connecting to outside addresses. You can look up an address at a service like ipinfo.io:

curl ipinfo.io/203.0.113.42

Replace the address with the one you're investigating. If it belongs to a hosting company you don't recognize, and the process has a generic name like "helper" or "updater", it's worth investigating further.

To focus on one process:

sudo lsof -i -P -n | grep -i "suspicious_process_name"

CoreLock's free scan includes a network check: it reports services on your Mac that listen on addresses other than loopback. A listening address alone doesn't prove another device can connect. To investigate a specific connection, the manual steps above are the way.

Check that SIP Is Enabled

System Integrity Protection (SIP) prevents even root-level processes from modifying protected parts of macOS. If SIP is off on your Mac and you didn't turn it off yourself, find out why.

csrutil status

You should see "System Integrity Protection status: enabled." SIP can only be turned off from Recovery, so if it says disabled, someone started up in Recovery and turned it off.

To turn it back on, start up in Recovery (on Apple silicon, press and hold the power button until you see the startup options, then click Options; on Intel, hold Command-R while starting up), open Terminal from the Utilities menu, run this, then restart:

csrutil enable

If You Might Be Targeted

If you're a journalist, activist, political figure or work in a sensitive field, and you think someone may be targeting you with mercenary spyware, the checks above aren't sufficient.

• Turn on Lockdown Mode. It's Apple's optional, extreme protection for "the very few individuals" who might be personally targeted by sophisticated digital threats, and it's on Macs with macOS Ventura or later (Apple: About Lockdown Mode). It limits some apps, websites and features.
• Check your iPhone too. Amnesty International's Mobile Verification Toolkit (MVT) analyzes iOS and Android devices for traces of known spyware, including Pegasus (MVT documentation). It doesn't scan macOS itself, but you can run it on your Mac against a Finder backup of your iPhone:

pip3 install mvt
mvt-ios check-backup --output /tmp/mvt-results /path/to/backup

• Get expert help. The most reliable check is a forensic review by specialists. Amnesty's Security Lab and Citizen Lab at the University of Toronto both do this work.

The Thorough Option: Restore the Mac

If you've found spyware and want to be certain it's gone, erase the Mac and set it up again. On a Mac with Apple silicon or the T2 chip, Erase All Content and Settings (System Settings > General > Transfer or Reset) is usually enough for commercial monitoring apps.

The most thorough option is a firmware restore with Apple Configurator, which erases the Mac and reinstalls its firmware, recoveryOS and the latest macOS. It works on Macs with Apple silicon or the T2 chip and needs a second Mac with macOS 14 or later (Apple: How to revive or restore Mac firmware):

1. Connect the Mac you're restoring to the second Mac with a USB-C cable that supports data, using the port Apple's article names for your model.
2. Put the Mac you're restoring into DFU mode. The button sequence varies by model, and Apple's article has the steps for each.
3. On the second Mac, open Apple Configurator.
4. Select the Mac in DFU mode, then choose Restore.

After the restore, set it up as a new Mac. Don't migrate everything back from a Time Machine backup, because the backup may contain the spyware's launch items. Copy your documents back by hand instead.

What Doesn't Work

A few common suggestions that won't catch real spyware:

Relying on XProtect alone. Apple's built-in scanner looks for known malware. A monitoring app that someone installed on purpose and granted permissions may not be on that list, and mercenary spyware is built to avoid detection.

Just restarting your Mac. If spyware uses a LaunchAgent, a LaunchDaemon or a login item, restarting simply starts it again.

Glancing at Activity Monitor. Spyware can name its processes to look like part of macOS. Check where a process runs from and who signed it, not just its name. Double-click it in Activity Monitor to see its path, then check the signature:

codesign -dv --verbose=4 /path/to/program

Building a Regular Checking Habit

For Mac threat research, good sources include Objective-See, Jamf Threat Labs and SentinelOne Labs. Their write-ups show the same places to look that this post covers: launch items, permissions, profiles and network connections.

Make it a monthly habit. Set a calendar reminder and spend 15 minutes on the checks in this post. Most months, nothing will have changed, and that's the point: you're confirming it.

If you want to automate part of this, CoreLock's free scan (CoreLock is my product) checks running apps, network, app permissions, startup items, AI agents and your Downloads folder, with no account and as often as you like. With Full Disk Access, its free Privacy report lists the apps macOS has allowed to use Screen Recording, Accessibility, Full Disk Access, Input Monitoring, the camera and the mic. It shows what macOS granted, not what an app actually used, and it doesn't detect stalkerware as such.

Spyware is a solvable problem if you know where to look. Now you do.