Step-by-Step Malware Removal from macOS Recovery Mode

Malware on a Mac can interfere with security software, block system settings, redirect browsers, or load automatically whenever macOS starts. When a threat prevents normal access, macOS Recovery provides a separate environment for checking the startup disk, securing data, and reinstalling the operating system.

Recovery Mode is not a universal antivirus scanner. Its strongest purpose is repairing, erasing, and reinstalling macOS when ordinary cleanup is unreliable. The safest method depends on the type of infection, whether important files are backed up, and whether the Mac uses Apple silicon or an Intel processor.

Recognize When Recovery Mode Is Appropriate

Use Recovery Mode when malware prevents normal startup, repeatedly restores itself, disables security tools, or causes severe system instability. It can also help when a browser hijacker or trojan has modified system settings so extensively that normal troubleshooting is difficult.

Some warning signs need separate attention. A hijacked webcam, unknown remote-control activity, or stolen account credentials may require changing passwords and reviewing account sessions from a different trusted device. Pc Malware Expert’s webcam hijacking guide explains why camera access should be treated as a privacy and account-security incident, rather than only a software problem.

Prepare Before You Start

If macOS still loads, copy personal documents to a trusted external drive or secure cloud location. Avoid copying unfamiliar applications, executable files, browser extensions, or suspicious scripts, because a backup can preserve infected content. If ransomware is involved, keep an untouched copy of encrypted files for possible future analysis.

Connect the Mac to power and make sure you know the login password for an administrator account. FileVault may request a recovery key or user credentials before the startup disk can be unlocked. Also record your Apple Account details, since activation and reinstallation steps can require them.

A complete erase removes data from the selected volume. If the files are irreplaceable and no backup exists, stop before using Disk Utility’s erase function and consider professional data recovery advice. Repeatedly starting the Mac can overwrite recoverable information.

Enter macOS Recovery

The startup procedure depends on the hardware:

• Apple silicon: Shut down the Mac, then press and hold the power button until startup options appear. Select Options, choose Continue, and authenticate if requested.
• Intel-based Mac: Shut down or restart it, then immediately hold Command-R until the Apple logo or Recovery screen appears.
• Internet Recovery: On some Intel Macs, Option-Command-R can load Recovery over the internet when the local recovery system is unavailable.

After entering Recovery, select a user account if prompted and enter its password. If the screen shows macOS Utilities or a similar recovery menu, the system is ready for disk repair, Terminal access, or reinstallation.

If Recovery fails to load, disconnect unnecessary USB devices, verify the internet connection, and try again. An external keyboard may be needed for some Intel models. Do not use random command-line instructions from unverified sources, as a destructive command can erase the wrong volume.

Scan and Clean the Startup Disk

Open Disk Utility and choose View > Show All Devices. Select the internal physical disk and run First Aid on the volumes and containers beneath it, following the visible hierarchy. First Aid repairs certain file-system problems, but it does not identify every malicious file or guarantee that malware has been removed.

For a non-destructive attempt, restart into normal macOS or Safe Mode after disk repair and run a reputable, updated malware scanner. Recovery Mode itself usually does not provide a full third-party malware scan. Remove suspicious login items, browser extensions, profiles, and applications only after confirming what they are; deleting system files manually can make macOS unbootable.

These options have different effects and risks:

Action	Data preserved	Best use	Main limitation
First Aid	Yes	Repairing file-system errors	Does not remove all malware
Safe Mode cleanup	Usually	Removing startup items and scanning	May not work if macOS is badly compromised
Reinstall macOS	Usually, if the volume is not erased	Replacing damaged system components	Does not guarantee removal of user-level threats
Erase and reinstall	No	High-confidence cleanup	Permanently removes data from the selected volume

If the infection survives normal cleanup, or you cannot trust the existing operating system, proceed with a clean installation. Keep suspicious files off the Mac until they have been examined.

Erase and Reinstall macOS

From the Recovery utilities window, open Disk Utility and identify the internal startup volume. On newer systems, this may appear as a macOS volume group with a separate data volume. Select the appropriate volume or volume group and choose Erase only after confirming that backups are complete.

Use the recommended APFS format for modern Macs and follow the on-screen prompts. If Disk Utility reports that the disk cannot be erased, check whether the correct physical device is selected and whether the volume is unlocked. Do not erase an external backup drive by mistake.

Close Disk Utility when the process finishes and choose Reinstall macOS. Follow the installation assistant, keep the Mac connected to power, and maintain a stable internet connection. The download and installation may take time, and the Mac can restart several times.

After installation, install system updates before restoring data. Set up the Mac as a new computer when possible rather than automatically transferring every application, extension, and system setting. Restore documents selectively from a verified backup, then download applications from official publishers or the Mac App Store.

Habits That Reduce Reinfection

A clean installation is only part of recovery. Review browser extensions, login items, configuration profiles, and applications before allowing them to run again. Use unique passwords and enable multifactor authentication for email, Apple Account, financial, and social media services.

For additional practical guidance, review these Mac security tips when configuring updates, backups, and safer browsing habits.

• Keep macOS, browsers, and installed applications updated.
• Use a reputable security tool and schedule regular scans.
• Maintain offline or versioned backups that ransomware cannot modify.
• Grant camera, microphone, accessibility, and screen-recording permissions only when necessary.
• Avoid pirated software, unexpected attachments, and fake update notifications.

If malware affected an account, change its password from a trusted device and revoke unknown sessions or application access. Monitor financial and email accounts for unusual activity, especially when spyware or remote-access malware may have been present.

When Recovery Mode cannot repair the disk, the Mac shows signs of hardware failure, or sensitive information may have been exposed, preserve relevant evidence and contact a qualified Apple technician or cybersecurity professional. Use this guide as an educational cleanup path, and take the next safe step before reconnecting the Mac to your normal network.