CoreLock checks your Mac with a six-check scan: running apps, network, app permissions, login and background items, AI agents, and the Downloads folder. The checks add up to a 0 to 100 Security Score, and background scans run every 15 minutes by default. The Downloads check compares files against a built-in list of known-malware hashes and CoreLock's malware-signature (YARA) rules. Scanning runs on your Mac. Optional AI explanations, off by default, send a summary to our servers; your files are never uploaded. The local checks need no account.
Six checks, one Security Score, and screens anyone can read. The local checks need no account.
Six checks: running apps, network, app permissions, login and background items, AI agents, and your Downloads folder. The running apps check flags known-bad tools, such as crypto miners, and risky command lines among your 100 busiest processes.
6 checks, every 15 minutes by defaultLast scan: 2 min ago · 6 checks
Security Score
Risky command line: reverse shell
bash connecting out to port 4444
Unsigned item in LaunchAgents
With Full Disk Access, CoreLock lists the permissions macOS has granted, such as camera, microphone, contacts, photos, and files and folders, plus Screen Recording, Accessibility, Full Disk Access and Input Monitoring. The scan flags sensitive permissions left behind by apps you removed. Revoke opens the right page of System Settings, where you turn access off.
What macOS has grantedWhat macOS has granted
Camera
4 apps
Microphone
2 apps
Contacts
1 app
Files and Folders
3 apps
The Processes screen lists your 100 busiest processes, sorted by CPU, with friendly names for common ones and each one's CPU and memory use. You can stop processes you own.
100 busiest processes100 busiest, sorted by CPU
Busiest processes
Chrome
18% CPU
1.2 GB
VS Code
12% CPU
890 MB
Slack
4% CPU
340 MB
Stop: available for processes you own.
Every check has a clear scope. Here is what CoreLock looks at, in plain terms.
When you choose Re-verify, checks the code signature and Gatekeeper status of the apps in /Applications and ~/Applications. Flags unsigned apps and broken or expired signatures.
Checks files in your Downloads folder against a built-in list of known-malware hashes and 19 malware-signature (YARA) rules. A signature match is worth a look, not proof of harm, and nothing is quarantined automatically. Scripts and Windows installers also get simple checks. It doesn't look inside Mac app bundles.
Flags services listening beyond this Mac. Listening doesn't prove anyone can reach them. The Network screen lists your apps' open connections by IP address and port.
Reviews the LaunchAgents and LaunchDaemons folders at each scan and flags unsigned or unusual items. Show in Finder takes you there; you remove items yourself.
Shows which apps macOS lets use your camera, microphone, contacts, photos, and files and folders, and which hold Screen Recording, Accessibility, Full Disk Access or Input Monitoring. Needs Full Disk Access.
Recognizes supported AI agents, such as Claude Code, Cursor and GitHub Copilot, while they run, and shows the files, connections and child processes they have open. It's a snapshot, not a recording.
Turns on the macOS firewall and Stealth mode, Public Wi-Fi mode (macOS 26 and later), Private Mac name and Pause, and shows which sharing services are on.
Hidden decoy files. If a program changes or deletes one, you get a notification within about a minute. It's an early warning; it doesn't stop ransomware or restore files.
Off by default. Signed in, with AI explanations on, you can ask questions in plain English, in general or about a finding. It can't look at your Mac by itself.
Scanning runs on your Mac, and the Security Score is worked out there. AI explanations are off until you turn them on. When they are on, a summary goes to our servers: system stats, your 25 busiest programs (name, ID, CPU and memory), connection counts and disk totals. Never your files. Questions you ask Ask CoreLock go to our servers too. File reputation checks are also off by default; when on, file fingerprints (SHA-256 hashes, not contents) are checked against an online malware-hash database. On Pro, with cloud sync turned on, scan scores, issue counts, fix history and two settings sync to your account.
Known macOS malware. Learn how each threat works, signs of infection, and step-by-step removal guides.
Atomic Stealer (AMOS) is a macOS information stealer that Cyble found advertised on Telegram in April 2023 for $1,000 a month, sold together...
Realst is a macOS information stealer written in Rust. Security researcher iamdeadlyz first reported the campaign, and SentinelOne found it ...
AdLoad is one of the most widespread adware loaders on macOS and has been around since at least 2017 (SentinelLabs). It installs a persisten...
Shlayer is a macOS dropper that installs adware and potentially unwanted programs. Kaspersky named it the most common macOS threat of 2019, ...
Banshee Stealer appeared in mid-2024 and was rented out for $3,000 a month through Telegram and the XSS and Exploit forums (Check Point Rese...
EvilQuest, also named ThiefQuest, was found in 2020 in trojanized pirated Mac apps, such as an unsigned copy of the DJ app Mixed In Key (Obj...
KeRanger was hidden in two installers of Transmission 2.90 that were posted on Transmission's own website on March 4, 2016. They were signed...
Silver Sparrow is an activity cluster Red Canary reported in February 2021. Its installer packages used the macOS Installer JavaScript API t...
Trend Micro described XCSSET in August 2020: it inserts code into local Xcode projects so the payload runs when the project builds, and it c...
Kandji found Cuckoo in 2024 in a universal app named DumpMediaSpotifyMusicConverter, then in converters from tunesolo, fonedog, tunesfun and...
Uptycs found MacStealer advertised on the dark web in March 2023, sold as builds (the seller asked $100 per build). It runs on macOS Catalin...
Pirrit has been known on Windows since 2014, and a Mac version was spotted in 2016 (Check Point). Check Point describes it downloading an 'i...
MITRE ATT&CK describes Bundlore as macOS adware in use since at least 2015 that, though categorized as adware, has many features associated ...
Lazarus Group is a North Korean state-sponsored group attributed to the Reconnaissance General Bureau and active since at least 2009 (MITRE ...
Jamf Threat Labs described RustBucket in April 2023 and suspects a North Korean state-sponsored actor; others attribute it to BlueNoroff, a ...
ClickFix is a social-engineering technique that MITRE ATT&CK lists as User Execution: Malicious Copy and Paste (T1204.004). A page shows a b...
Cado Security (now part of Darktrace) found Cthulhu Stealer rented out by the 'Cthulhu Team' over Telegram for $500 a month, with affiliates...
Genieo is a browser hijacker that behaves like adware: it acts as a search engine that shows sponsored results and is usually installed by b...
MITRE ATT&CK describes Proton as a macOS backdoor focused on data theft and credential access; it was offered for sale on underground forums...
Microsoft traced UpdateAgent from a basic information stealer in September 2020 to a distributor of second-stage payloads by October 2021. I...
CoinMiner is a label for macOS malware that mines cryptocurrency on the victim's Mac for the attacker. ESET documented LoudMiner in June 201...
ESET researchers found CloudMensis in April 2022; the earliest compromise they could date was February 4, 2022. It uses public cloud storage...
OSX.VSearch is Malwarebytes' name for a family of macOS adware that is usually installed by bundlers; it can turn text on web pages into hyp...
Check Point found OSX/Dok in April 2017. It came as Dokument.zip in phishing emails, mostly aimed at European users (one German-language lur...
Bitdefender disclosed Backdoor.MAC.Eleanor in July 2016. EasyDoc Converter.app posed as a drag-and-drop file converter but only downloaded a...
All Mac threats · How to check your Mac for malware · How to remove malware
Check which apps have access to your camera, microphone, screen, and files. Learn how to revoke permissions you didn't approve.
Camera access lets an app take photos and video with your Mac's built-in camera or a connected webcam. The list in Syste...
Microphone access allows an app to capture audio through your Mac's built-in microphone or any connected external microp...
Screen Recording lets an app capture what's on your screen, including other apps' windows, documents and messages, not j...
Apple describes Full Disk Access as access to all files on your Mac, including data from other apps (for example Mail, M...
Accessibility access lets an app control your Mac: read the interface of other apps, click buttons, type, and move windo...
Input Monitoring lets an app watch your keyboard, mouse and trackpad even while another app is in front. Apple's descrip...
Location Services lets apps, system services and websites use your Mac's current location, which the Mac works out from ...
Contacts permission gives an app access to your address book: names, phone numbers, email and street addresses, birthday...
Calendars permission gives an app access to your events: titles, times, locations, attendees and notes. That can reveal ...
Photos permission gives an app access to your Photos library: pictures, videos and their details, such as when and where...
Since macOS 10.15, apps need your consent before they open files in Documents, Downloads, Desktop, iCloud Drive and netw...
Automation lets one app control another through Apple events, which is what AppleScript uses. The app can then tell Find...
Apple describes Developer Tools as allowing apps to run software that doesn't meet the system's security policy. Develop...
Bluetooth permission lets an app use Bluetooth on your Mac to find and talk to nearby devices: mice, keyboards, headphon...
All Mac permissions · How many apps have camera access? · Is your Mac sending data without permission?
Check which permissions popular Mac apps actually request — camera, mic, screen recording, accessibility, and full disk.
Yes. Zoom uses the camera and microphone for meetings and Screen & System Audio Recording to share your screen...
Yes. Microsoft Teams uses the camera and microphone for calls and asks for screen recording the first time you...
Sometimes. Slack asks for the microphone, camera and screen recording for huddles and for recording audio or v...
Yes, for voice. Discord uses the microphone for voice chat, and the camera and screen recording only when you ...
Only when websites ask. Chrome asks macOS for the camera, microphone and screen recording so websites such as ...
Yes, that's its job. Loom needs screen recording to capture your screen and the camera and microphone for the ...
Yes. OBS Studio asks for screen recording to capture your display, windows and apps, the camera for webcams an...
Yes, Accessibility. The Grammarly app for Mac uses Accessibility to read and suggest changes to what you type ...
Mostly no. 1Password uses Accessibility to fill in logins in other Mac apps, Automation only if you let it fil...
Yes, Accessibility, and only that. Rectangle uses Accessibility to move and resize your windows with keyboard ...
Yes, Full Disk Access. CleanMyMac asks for Full Disk Access so it can scan your whole Mac for junk files and m...
Sometimes. Dropbox asks for Accessibility for the Dropbox badge, seeing who viewed your files and better sync ...
No. Playing music needs none of the camera, microphone, screen recording, Accessibility or Full Disk Access. I...
Only for AI Meeting Notes. Notes and docs need no special permissions, but Notion's AI Meeting Notes asks for ...
Only for audio chat. Figma asks for the microphone when you join an audio conversation in a Design, FigJam or ...
Only when websites ask. Like any browser, Arc asks macOS for the camera, microphone and screen recording so we...
Yes, for calls. Telegram uses the microphone and camera for voice and video calls and for voice and video mess...
Yes, for calls. WhatsApp uses the microphone for calls and the camera for video calls, and screen recording on...
Yes, for calls. Signal Desktop uses the microphone for calls and voice messages, the camera for video calls, a...
Yes, Accessibility. Raycast uses Accessibility to switch windows, search menu bar items and read the app in fr...
Yes. CleanShot X needs screen recording to take screenshots and record your screen, and the microphone only if...
Yes, Accessibility, and screen recording if you allow it. Bartender needs Accessibility to move and arrange yo...
Not sure what a process on your Mac does? Look it up here. Learn if it's safe, what causes high CPU, and when to worry.
mds_stores is a core macOS system process responsible for maintaining the Spotlight search index. It reads file metadata — names, content, d...
kernel_task is the macOS kernel's own process. It handles core operating system functions including memory management, process scheduling, h...
WindowServer is the core macOS process responsible for compositing and rendering everything you see on screen. It manages all window drawing...
launchd is the first process that runs when macOS boots (PID 1) and serves as the system's init and service management framework. It is resp...
trustd is the macOS daemon responsible for evaluating certificate trust chains. Whenever your Mac needs to verify an SSL/TLS certificate for...
cloudd is the background daemon that handles CloudKit operations on macOS. CloudKit is Apple's framework for syncing data between your devic...
bird is the macOS daemon responsible for syncing files between your Mac and iCloud Drive. It handles the upload and download of documents, D...
nsurlsessiond is the macOS background daemon that handles URL-based download and upload tasks on behalf of applications. When an app uses Ap...
mdworker is a helper process spawned by the Spotlight metadata server (mds). While mds_stores manages the search index database, mdworker pr...
coreaudiod is the central audio management daemon on macOS. It handles all audio input and output routing, manages audio device connections,...
loginwindow manages your macOS login session from start to finish. It presents the login screen, authenticates your credentials, launches th...
distnoted is the macOS daemon that delivers distributed notifications between processes. When one application needs to notify other applicat...
cfprefsd manages the macOS preferences system. It handles reading and writing all .plist preference files for both system and user applicati...
sandboxd supports the macOS App Sandbox, the security technology that restricts what an app can reach (files, the network, hardware devices ...
syspolicyd implements macOS Gatekeeper — the security feature that verifies applications are from identified developers or the Mac App Store...
tccd manages the macOS TCC (Transparency, Consent, and Control) framework — the privacy permission system that controls which apps can acces...
powerd is the macOS daemon responsible for system power management. It controls sleep/wake behavior, display sleep timing, battery charge ma...
fseventsd is the macOS daemon that monitors and records file system changes as they happen. It maintains a persistent log of which directori...
symptomsd is a macOS system daemon. Its man page says only that it provides services for Apple's Symptom Framework, that it has no configura...
rapportd is the macOS daemon that handles local device discovery and communication for Continuity features such as Handoff and taking iPhone...
sharingd is the macOS daemon that handles AirDrop file transfers, Shared Computers discovery in Finder, and parts of the Handoff system. It ...
bluetoothd is the macOS daemon that manages all Bluetooth hardware and connections. It handles device pairing, maintains connections to pair...
Many guides describe wifid as the Mac's Wi-Fi management daemon. On a Mac running macOS 26.5 (checked October 29, 2026) there was no wifid p...
syslogd is the macOS system logging daemon that collects, stores, and manages log messages from the kernel, system services, and application...
notifyd is the macOS daemon that provides the low-level notify(3) notification mechanism used for lightweight inter-process communication. U...
UserEventAgent is a macOS daemon that loads system-provided plug-ins to handle high-level system events that launchd can't monitor directly ...
AMPDevicesAgent is a macOS agent that manages communication between your Mac and connected iPhones, iPads and iPods for syncing in the Finde...
airportd is the macOS daemon responsible for managing the Wi-Fi hardware and wireless network connections. It handles scanning for available...
coreduetd is a macOS daemon that collects usage patterns to power proactive features such as Siri Suggestions. On macOS 26.5 its launchd job...
accountsd is the macOS daemon that manages all internet accounts configured in System Settings, including iCloud, Google, Microsoft Exchange...
mDNSResponder is the macOS daemon that implements Bonjour, Apple's zero-configuration networking protocol. It handles multicast DNS (mDNS) f...
XProtect is the malware protection built into macOS. Apple describes signature-based detection and removal of malware, with YARA signatures ...
MRT (Malware Removal Tool) is Apple's built-in tool for removing known malware that has already been installed. Apple's Platform Security gu...
softwareupdated is the macOS background daemon responsible for checking, downloading, and preparing system software updates. It periodically...
CalendarAgent is the macOS background process that manages calendar data synchronization between the Calendar app and your configured calend...
All Mac processes · Hidden processes on your Mac · Why is my Mac running slow?
Download CoreLock and see what the six checks find on your Mac. The local checks need no account.
Free forever · No credit card · Apple Notarized