MRT (Malware Removal Tool) is Apple's built-in tool for removing known malware from a Mac, and Apple's current security guide describes malware removal as part of XProtect; MRT is signed by Apple and safe. On a Mac with macOS 26.5, MRT.app (version 1.93) was still installed and XProtect held a removal module named MRTv3, so MRT running briefly is normal.
Last reviewed · 1 source
One Mac, macOS 26.5 (25F71) on Apple silicon, read with ps and codesign on October 29, 2026
| Path | /Library/Apple/System/Library/CoreServices/MRT.app/Contents/MacOS/MRT |
|---|---|
| Runs as | root, when its launch daemon starts it |
| Signed by | Apple (Software Signing), identifier com.apple.MRT |
| Note | Not running at capture time. MRT.app version 1.93 is installed with a launch agent (com.apple.MRTa) and a launch daemon (com.apple.MRTd). |
MRT (Malware Removal Tool) is Apple's built-in tool for removing known malware that has already been installed. Apple's Platform Security guide now covers malware removal under XProtect, which includes an engine that remediates infections based on updates Apple delivers automatically and keeps checking for infections periodically. On a Mac with macOS 26.5, MRT.app version 1.93 was still installed in /Library/Apple/System/Library/CoreServices with launch jobs com.apple.MRTa and com.apple.MRTd, and XProtect.app contained a removal module named XProtectRemediatorMRTv3.
Temporary high CPU usage when MRT runs a post-update scan of the system
Disk activity spikes as MRT scans applications and system directories
MRT removing a legitimate application it mistakenly identifies as malware (rare)
Confusion about what MRT detected, since it operates silently without notifications
When MRT runs, usually after an automatic security update, let it finish. High CPU from MRT means it is checking for known malware, and it exits on its own; interrupting it only delays the check.
Run 'log show --predicate "process == \"MRT\"" --last 24h' in Terminal to see MRT's recent activity logs. This shows what MRT scanned and whether it found or removed any malware. The log messages indicate which malware signatures were checked.
Run 'system_profiler SPInstallHistoryDataType | grep -A 5 MRT' in Terminal to see when MRT was last updated. Security data like this arrives through automatic updates, so in System Settings > General > Software Update, click the info button next to Automatic Updates and keep 'Install Security Responses and system files' on.
MRT has no scan button. Run 'xprotect status' in Terminal to confirm XProtect's launch and background scans are enabled (both were on a Mac with macOS 26.5), and 'xprotect version' to see its signature version.
MRT running briefly after a system update is completely normal and expected. Be concerned if MRT is running repeatedly in short intervals, which may indicate it is detecting malware but unable to fully remove it. If you suspect malware that MRT cannot handle, consider using a dedicated malware scanner for a second opinion. Also investigate if MRT logs show repeated detections of the same threat.
XProtect is the malware protection built into macOS. Apple describes signature-based detection and removal of malware, w...
syspolicyd implements macOS Gatekeeper — the security feature that verifies applications are from identified developers ...
sandboxd supports the macOS App Sandbox, the security technology that restricts what an app can reach (files, the networ...
Jamf Threat Labs described RustBucket in April 2023 and suspects a North Korean state-sponsored acto...
ClickFix is a social-engineering technique that MITRE ATT&CK lists as User Execution: Malicious Copy...
System Settings › Privacy & Security › Accessibility (on macOS 27, some developers' guides call this pane Device Control and Data Access)
No. MRT (Malware Removal Tool) is Apple's official malware cleanup utility built into macOS. It is code-signed by Apple, distributed through software updates, and protected by System Integrity Protection. Its entire purpose is to remove malware from your Mac, not to cause harm. Seeing it in Activity Monitor is a sign your Mac's security is working.
Apple's current security guide puts both jobs under XProtect: blocking known malware before it runs, and remediating malware that has already run. MRT is the older standalone removal tool; on macOS 26.5 it was still installed (MRT.app 1.93) alongside XProtect's own removal modules, one of them named XProtectRemediatorMRTv3.
Yes. MRT runs automatically in the background when Apple pushes new malware signature updates. You do not need to launch it manually, and there is no user interface. It scans your system, removes any detected malware, and exits quietly. Apple's guide says XProtect's remediation engine removes malware when it receives updated information and keeps checking for infections periodically.
MRT can remove malware that Apple has specifically identified and created removal signatures for. It is effective against known threats but cannot detect or remove novel malware, sophisticated rootkits, or threats that Apple has not yet cataloged. For a second look, a separate check helps, such as CoreLock's free scan, which covers running apps, startup items and app permissions among its six checks, though no tool catches everything.
CoreLock's scan of running apps, network, permissions, startup items, AI agents and Downloads is free, with no account.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser