What to do the hour after you think your Mac was compromised
· 6 min read
The instinct is to start hunting through the Mac for whatever got in. That is the wrong order. Your accounts are where the damage happens, and they are reachable from anywhere; the machine is only one route to them.
First twenty minutes: the accounts
1. Disconnect from the internet. Turn off Wi-Fi. This stops anything in progress.
2. From a different device, change your passwords, in this order:
- Email, because it is the reset route for everything else
- Apple Account
- Banking
- Anything else with money or authority attached
Use a device you trust. If the only other device is a phone that syncs with the same account, it is still better than the suspect machine.
3. Check your Apple Account for changes. At account.apple.com: trusted devices, trusted phone numbers, recovery contacts. Remove anything you do not recognise. Attackers add their own recovery route so they can return.
4. Check email forwarding rules. A common and quiet persistence trick is a rule that forwards or deletes messages, so you never see the alerts. Check the rules and filters in every mail account.
5. Sign out of all sessions, where services offer it.
Next twenty minutes: what is on the machine
Now the Mac. Most unwanted software installs itself to start automatically, so that is where to look.
ls -1 ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons 2>/dev/null
Read the names. Anything you do not recognise, look at what it runs:
cat ~/Library/LaunchAgents/whatever.plist
The ProgramArguments key names the actual command. A path pointing somewhere odd, or to software you never installed, is your answer.
Then System Settings, General, Login Items, both sections.
Then System Settings, Privacy & Security, Profiles. A configuration profile you did not install is a strong signal; adware and management software both use them, and a profile can control settings and traffic. If a Profiles section appears and you did not put anything there, that is significant.
Then browser extensions, in every browser. Broad permissions on an extension you do not remember installing is a common route.
Finally, check what has permissions it should not: System Settings, Privacy & Security, then Accessibility, Screen Recording, Full Disk Access and Automation. Anything unexpected with those grants can see and control a great deal. Auditing which apps can see your camera and microphone covers the related check.
Deciding whether to erase
Honest guidance: if someone had remote access, or you cannot account for what you find, erase and reinstall.
Removing individual pieces works when you know exactly what happened, such as installing something dubious that you can name. When the entry point is unknown, you cannot be confident you found everything, and the cost of being wrong is that they come back.
Erasing means: back up your documents only, not applications and not your Library folder, then erase and reinstall macOS, then restore the documents. Restoring the whole account brings back whatever you were trying to remove. What a clean install actually fixes covers doing it properly.
The scenarios, and what each needs
You rang a number from a pop-up and let someone in. Assume compromise. Remove the remote access software, change every password, and erase. The fake support call covers the pattern.
You entered your password on a phishing page. The machine is probably fine; the account is not. Change passwords, check the account’s recovery settings, enable two-factor if it was not. Phishing that targets Mac users.
You installed something from a dubious download. Remove it, check login items and profiles, run a reputable on-demand scanner once.
Odd behaviour with no known cause. Often not compromise at all. Check for a runaway process before assuming the worst. A Mac that is suddenly slow.
Afterwards
Turn on two-factor everywhere. The single most effective change.
Move to a password manager with unique passwords, so one breach stays contained.
Check your backups still work. Testing a backup before you need it.
If money or work data was involved, tell your bank and your employer. Both get worse with delay.
Questions
How do I know for certain the Mac is clean? You cannot, with certainty. That is why erasing is the confident answer when the entry point is unknown.
Should I install antivirus now? A one-off scan with a reputable on-demand tool is reasonable. Permanent antivirus addresses a smaller share of the real risk than the habits above. Does a Mac need antivirus.
They had my screen for ten minutes. What did they see? Whatever was open, plus anything they opened. Assume any password visible or saved in the browser is known.
Is my iPhone affected too? Not directly, and if your Apple Account was compromised, the account covers both. Changing the password protects them together.