Surprised that no one has yet mentioned ObjectiveSee tools, KnockKnock and BlockBlock: https://objective-see.com/ https://objective-see.com/ KnockKnock looks

Surprised that no one has yet mentioned ObjectiveSee tools, KnockKnock and BlockBlock: https://objective-see.com/ https://objective-see.com/ KnockKnock looks for malware like this rogue launchd service. You use it to quickly check for the presence of some forms of malware. It can integrate with VirusTotal databases. BlockBlock runs as a background process, and blocks installation of launchd services and kernel extensions. It displays a (rather technical) alert when something tries to install such features. Relatively lightweight. I also use Little Snitch, from (unrelated) Objective Development: https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html It's quite a bit more complicated, a firewall with a sophisticated user interface that blocks outgoing traffic by default. The alerts let you add rules to allow such traffic. It can generate a _lot_ of alerts as you gradually build up a set of rules that match your usual usage. I've recently re-installed macOS from Recovery, and I was pleasantly surprised that Little Snitch wasn't often triggered as I went about using my Mac. I wouldn't necessarily recommend blocking firewall like Little Snitch for usual users; they wouldn't be able to deal with all the alert noise. Like Windows Vista, all over again. But I've come to rely on it... ObjectiveSee has a similar, free tool, if you want to see what I mean. I strongly recommend ObjectiveSee tools. They are free and (I believe) open source. https://objective-see.com/ https://objective-see.com/