XProtect is the malware protection built into macOS: it checks apps against Apple's signatures when they first open, when they change and when the signatures update, and it runs as several processes, including xprotectd and XprotectService; it's part of macOS and safe. High CPU from XprotectService during a background scan is normal and passes, and 'xprotect version' in Terminal shows which signature version you have.
Last reviewed · 2 sources
One Mac, macOS 26.5 (25F71) on Apple silicon, read with ps and codesign on October 29, 2026
| Path | /Library/Apple/System/Library/CoreServices/XProtect.app/Contents/MacOS/XProtect |
|---|---|
| Runs as | root, when its launch daemon starts it |
| Signed by | Apple (Software Signing), identifier com.apple.XProtectFramework.XProtect |
| Note | XProtect.app wasn't running at capture time; its launch daemon runs it about every 6 hours, daily and weekly. Running: /usr/libexec/xprotectd and XprotectService, both as root. Signature data (XProtect.bundle) version 5368; XProtect.app version 170. |
XProtect is the malware protection built into macOS. Apple describes signature-based detection and removal of malware, with YARA signatures Apple updates automatically, independent of macOS updates. It checks for known malicious content when an app is first launched, when an app has changed, and when its signatures are updated; it blocks known malware and moves it to the Trash, remediates infections and keeps checking for them periodically. On a Mac with macOS 26.5 it ran as xprotectd and XprotectService (both as root), with XProtectBridgeService and XProtectPluginService beside them, and its removal modules, named XProtect Remediator, sit inside XProtect.app.
High CPU usage during a background system scan, especially after an XProtect signature update
XprotectService or syspolicyd consuming resources while scanning large applications
Temporary slowdowns when opening newly downloaded apps for the first time
False positives blocking legitimate software from launching
XProtect's background scans run on a schedule (on macOS 26.5: about every 6 hours, daily and weekly) and pass on their own. If XprotectService is busy, let it finish rather than force-quitting it.
Run 'xprotect version' in Terminal; on macOS 26.5 it printed 'Version: 5368' and the date it was installed. Apple says macOS checks for XProtect updates daily by default, and 'xprotect check' shows the newest version available.
When XProtect finds known malware, Apple says it blocks it, moves it to the Trash and tells you in the Finder. Don't try to get around that: empty the Trash, and if you need the app, download it again from its developer's own site or the App Store.
Run 'xprotect status' in Terminal. On macOS 26.5 it reports whether XProtect launch scans and background scans are enabled; both should say enabled.
XProtect using CPU during a scan is normal. Look closer if 'xprotect status' says scans are disabled, if 'xprotect version' shows an install date many weeks old, or if macOS keeps warning about the same item after you've deleted it; then find where it comes back from, often a login item or launch agent.
CoreLock's free scan checks your Downloads folder against its own built-in malware-hash list and 19 YARA rules. That's a separate check from XProtect, not a replacement: a match is shown as worth a look, and CoreLock never quarantines a file on its own.
syspolicyd implements macOS Gatekeeper — the security feature that verifies applications are from identified developers ...
MRT (Malware Removal Tool) is Apple's built-in tool for removing known malware that has already been installed. Apple's ...
sandboxd supports the macOS App Sandbox, the security technology that restricts what an app can reach (files, the networ...
MITRE ATT&CK describes Bundlore as macOS adware in use since at least 2015 that, though categorized ...
Lazarus Group is a North Korean state-sponsored group attributed to the Reconnaissance General Burea...
System Settings › Privacy & Security › Full Disk Access
XprotectService is one of XProtect's own processes. On macOS 26.5 it runs as root from /System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc, signed by Apple with the identifier com.apple.XprotectFramework.AnalysisService. It's normal and part of macOS, and it can use noticeable CPU while XProtect scans.
XProtect Remediator is the removal side of XProtect: modules for specific malware families, which Apple's security guide describes as XProtect's engine to remediate infections. On macOS 26.5, XProtect.app held 24 of them, each named XProtectRemediator plus a family, among them Adload, Bundlore, Dolittle, Genieo, KeySteal, MRTv3, Pirrit and Trovi.
XProtect detects malware Apple has identified, with rules more generic than a single file's hash, so it can also catch variants Apple hasn't seen, and Apple says it includes an engine that looks for unknown malware by its behavior. No scanner catches everything. A second, separate check can help: CoreLock's free scan, for example, looks at running apps, network, permissions, startup items, AI agents and the Downloads folder, though it can't promise to catch every threat either.
Apple says macOS checks for XProtect updates daily by default, and the updates arrive independent of macOS updates. To see what you have, run 'xprotect version' in Terminal; on our test Mac it showed version 5368, installed October 22, 2026.
Usually not noticeably. It checks an app when it first opens or has changed, so a new download can take a moment longer to open. Background scans run on a schedule: on macOS 26.5 its launch daemon runs one about every 6 hours (allowed on battery) and one daily and one weekly (on power only), and XprotectService can use noticeable CPU while one runs.
You shouldn't, and there's no setting for it. XProtect lives in /Library/Apple/System/Library/CoreServices, a folder System Integrity Protection guards, and runs automatically with no configuration. 'xprotect status' shows whether its launch and background scans are enabled.
CoreLock's scan of running apps, network, permissions, startup items, AI agents and Downloads is free, with no account.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser