How to protect your computer from malware on Windows and Mac

What malware is, and the main types

Malware is software that works against the person using the device. NIST's glossary defines it as hardware, firmware or software intentionally placed in a system for a harmful purpose. The FTC puts it in consumer terms: harmful software installed without your knowledge, used to steal usernames, passwords and account numbers, show you unwanted ads, or lock your files until you pay.

The names you will read describe different things: how the malware spreads (virus, worm), how it gets you to run it (trojan), what it does once running (ransomware, spyware, infostealer, cryptominer) and how it hides (rootkit, fileless techniques). One infection is often several of these at once.

The type to understand first in 2026 is the infostealer. Microsoft's Digital Defense Report 2025, published in October 2025, calls the rapid rise of infostealers one of the most concerning trends of its reporting year (July 2024 to June 2025): families such as Lumma Stealer, RedLine, Vidar and Atomic Stealer are now used as the first stage of an attack, and the passwords and browser session tokens they collect are sold on to other criminals, including ransomware groups. In one two-month window, between March 16 and May 16, 2025, Microsoft identified more than 394,000 Windows computers infected with Lumma alone. Keyloggers also come in hardware form, a small adapter between keyboard and computer, which our guide to snooping attacks covers.

How malware gets onto a computer in 2026

The same Digital Defense Report lists the initial access methods that Microsoft's Defender Experts service saw in its notifications over the year:

Two cautions before reading much into it. These are detections from a managed service that watches organizations, not every home PC, and password spraying targets accounts rather than computers. The lesson still carries over: the two largest routes, and most of the rest, need a person to paste, open or download something. When Microsoft's incident responders looked at confirmed breaches instead, 28% began with phishing or social engineering, 18% with unpatched web-facing systems and 12% with exposed remote services.

Fake CAPTCHA and "fix it" pages (ClickFix)

ClickFix is the technique behind that 47%. A web page shows something familiar, such as a CAPTCHA check, a browser crash page or a message about a missing Word extension, and offers a way through. Clicking the button quietly copies a command to your clipboard, and the page tells you to press the Windows key and R, paste and press Enter, or to paste into Windows Terminal or PowerShell. Microsoft Threat Intelligence reported in August 2025 that these campaigns target thousands of enterprise and end-user devices every day, that recent lures imitate Google reCAPTCHA and Cloudflare Turnstile, and that most attack paths end in PowerShell or HTA scripts. The Digital Defense Report adds that these commands pull their payload straight into memory, a fileless process that traditional security tools often miss. MITRE ATT&CK tracks the technique as Malicious Copy and Paste (T1204.004).

It is not limited to one gang or one operating system. CISA and the FBI describe Interlock ransomware actors using fake CAPTCHAs this way, and name Lumma Stealer and DarkGate as other malware delivered through ClickFix. In a June 2025 campaign that Microsoft analyzed, the command copied for Mac users asked repeatedly for the account password, then used it to strip the downloaded file's quarantine attribute and bypass macOS security before launching Atomic macOS Stealer (AMOS).

Phishing links and attachments

Phishing is the second route: an email or message that impersonates a brand or a colleague, usually with urgency, and leads to a link or an attachment. Microsoft describes Lumma campaigns built around fake hotel reservation confirmations and cancellations, and CISA's advisory on LummaC2 (May 21, 2025) lists spearphishing links and attachments as a frequent way in, alongside fake CAPTCHAs. Office documents with macros used to be the classic attachment; Office for Windows now blocks macros in files from the internet by default, as described in the Windows section below.

Malvertising, search poisoning and fake downloads

Searching for software is itself a risk. Criminals buy search ads that point to a copy of a real vendor's site, and the FBI warned in December 2022 that these ads appear at the very top of results with minimal distinction from genuine ones. Microsoft saw ads on queries such as "Notepad++ download" and "Chrome update" lead to cloned vendor sites that delivered Lumma Stealer. In December 2024 it detected a malvertising campaign that started on illegal streaming sites, redirected visitors to payloads hosted on GitHub, and affected nearly one million devices. SEO poisoning is the same trick played through ordinary search results, and the Digital Defense Report names both as common delivery routes for infostealers.

Cracked software and fake updates

Pirated software is a delivery channel, not a bargain. Microsoft found cracked and pirated versions of legitimate applications bundled with Lumma and shared on file-sharing platforms; the modified installers show nothing unusual and run the malware after launch. Fake updates work the same way. The Interlock advisory describes drive-by downloads from compromised legitimate websites, and payloads disguised as Google Chrome or Microsoft Edge browser updates or, more recently, as updates for common security software.

USB drives and other removable media

Removable media is an old route that has not gone away. MITRE ATT&CK documents malware copied to USB drives that relies on AutoRun or on a file renamed to look legitimate, and notes that a phone plugged in over USB can appear as a drive too. Microsoft lists removable drives among the ways worms spread. The FTC's advice is to scan USB thumb drives and external drives with security software before using them.

Unpatched software

An unpatched browser, operating system or plug-in lets malware in without any download prompt. An exploit uses the flaw to get past the system's safeguards, and exploit kits on compromised pages, or in ads on legitimate ones, probe each visitor for several flaws at once (Microsoft). Exploits were only 1% of the initial access in Microsoft's notifications, but they need no mistake from you, which is why updates come first in both lists below.

Protect a Windows PC, layer by layer

Windows 11 includes most of what a home PC needs. The work is making sure each layer is on and stays on. If you are setting up a new computer, our Windows 11 setup guide covers these settings at first start.

1. Keep Windows and your apps updated

Security updates close the flaws that exploits use. Windows 10 reached end of support on October 14, 2025, and Microsoft warns that a PC without security updates is at greater risk from viruses and malware; consumer Extended Security Updates can cover a Windows 10 PC until October 12, 2027, as a bridge to Windows 11. Turn on automatic updates for Windows, your browser and every other app. Our guide to updating your computer or phone covers Windows, macOS and Linux.

2. Leave Microsoft Defender Antivirus on

The Windows Security app brings together Microsoft Defender Antivirus, Windows Firewall and Smart App Control. With real-time protection on, Defender scans files as you open and download them; if it is off, they are not scanned. Two further settings are worth switching on:

• Controlled folder access, Defender's ransomware protection, lets only trusted apps change files in protected folders. It is off by default; turn it on under Virus & threat protection > Ransomware protection.
• Memory integrity, under Device security > Core isolation, uses hardware virtualization to make it harder for malicious programs to hijack the PC through low-level drivers. It needs virtualization enabled in the PC's firmware.

3. Keep SmartScreen on

Microsoft Defender SmartScreen checks the sites you visit against a list of reported phishing and malware sites, and checks what you download against files known to be unsafe and files that are well known and frequently downloaded. A new installer it has never seen triggers a warning. For a "Notepad++" installer from a cloned site, that warning may be the only signal you get, so treat it as a stop sign rather than a formality.

4. Turn on Smart App Control

Smart App Control on Windows 11 checks every app you try to run. If Microsoft's cloud security service predicts the app is safe, it runs; if the service believes it is malicious or potentially unwanted, it is blocked; if the service cannot decide, the app runs only when it has a valid signature. There is no exception for individual apps, so an unsigned tool you rely on means switching the feature off. You will find it under App & browser control > Smart App Control settings; it is not available on Windows 10. Smart App Control used to be available only on a fresh installation of Windows 11, and some Microsoft pages still say so, but the FAQ, revised in August 2026, says recent Windows updates let you turn it on without a clean install.

5. Use a standard account for everyday work

An administrator can change settings, install software and access every file, and malware that runs in an administrator's session starts with the same power. Microsoft's guidance on user accounts says it is safer to have fewer administrators and to use standard accounts for day-to-day activities. The switch takes a few minutes:

1. Create a second account and make it an administrator: Settings > Accounts > Other users, add the account, then Change account type to Administrator.
2. Sign in with the new administrator account, open the same page and change your everyday account's type to Standard User.
3. Use the everyday account for mail, browsing and work. When something needs administrator rights, User Account Control stops and asks first, instead of letting the change happen silently.

6. Leave Office's macro block in place

VBA macros in Office files were for years a common way to deliver malware and ransomware, so Microsoft changed the default: Office on Windows blocks macros in files from the internet, such as email attachments, in Access, Excel, PowerPoint, Project, Publisher, Visio and Word. The change started rolling out to Current Channel with version 2206 on July 27, 2022. Office recognizes such files by their Mark of the Web, which Windows adds to browser downloads and email attachments. If an unexpected document tells you to unblock it in its file properties so the "content" can load, delete it instead.

Protect a Mac: updates, Gatekeeper and XProtect

Macs get malware too. Atomic, a macOS infostealer, accounted for 21% of the infostealer notifications in the Digital Defense Report's top five, second only to Lumma at 51%, and ClickFix pages now serve Terminal commands to Mac visitors. Apple's platform security guide describes three layers of defence built into macOS:

1. Prevent launch. Apps come from the App Store or, if from elsewhere, must pass Gatekeeper and notarization. Notarization means the developer submitted the app to Apple, which scanned it for known malware; Gatekeeper checks the Developer ID signature and the notarization, and asks for your approval before downloaded software opens for the first time.
2. Block. XProtect, the antivirus built into macOS, uses signatures Apple updates automatically and separately from system updates; by default the Mac checks for them daily. Apple can also revoke the notarization of an app later found to be malicious, and Gatekeeper then blocks it.
3. Remediate. XProtect includes an engine that removes malware that has already run, using updates Apple delivers automatically, and keeps checking for infections periodically.

Your part is small but it matters:

• Keep macOS updated in System Settings > General > Software Update, and use its settings to download and install updates automatically (Apple).
• Do not override Gatekeeper for software you are unsure of. Since macOS Sequoia, you can no longer Control-click to open software that is not signed correctly or notarized; you have to allow it in System Settings > Privacy & Security. A download page that walks you through that screen, or tells you to paste a command into Terminal, is the attack.
• Use a standard account day to day. The first account created on a Mac is an administrator, which can install apps, change settings and manage other users. Create a separate administrator for changes and a standard account for daily use.

Download and browse safely

Most of the routes above end with you running something. These habits remove most of them:

1. Get apps from the store first. Microsoft advises downloading software only from official websites or the Microsoft Store; Apple calls the App Store the safest place to get Mac apps.
2. Type the vendor's address instead of clicking a search ad. Both the FBI and the FTC give this advice; bookmark the download pages of software you update by hand.
3. Never install cracked or pirated software, key generators or "free" copies of paid apps. They are a standard infostealer carrier.
4. Update your browser from its own settings or menu, never from a web page that says you need an update.
5. Read installers before clicking Next. Bundled offers are how adware and potentially unwanted apps arrive; decline them, and keep reputation-based protection on in App & browser control, which also covers potentially unwanted apps.
6. Scan USB drives and external disks before opening files on them, and do not plug in drives you found.
7. Never call a number shown in a pop-up. The FTC notes that fake security warnings lead to scammers who ask for remote access, run a fake diagnostic test and charge you to fix a problem that does not exist.

Signs your computer has malware

Even with security software running, the FTC warns, malware can go undetected for a while. These symptoms, drawn from the FTC's list and the UK National Cyber Security Centre's guidance on infected devices, are worth a scan:

The absence of symptoms proves little. CISA notes that LummaC2 can send off credentials, wallets and MFA details without immediate detection, and a rootkit exists to make the system lie about what is running. If you ran something suspicious, or pasted a command, act on that alone.

What to do if your computer is infected

Work through these in order. The first two steps contain the damage; the rest undo it.

1. Disconnect it. Turn off Wi-Fi and unplug the network cable. CISA's #StopRansomware Guide advises isolating affected devices this way, and powering them down only if you cannot disconnect them. Until the computer is clean, stop signing in to email, banking or shopping sites on it, as the FTC advises.
2. Scan it. On Windows, update Microsoft Defender Antivirus, then run an offline scan: Windows Security > Virus & threat protection > Scan options > Microsoft Defender Antivirus (offline scan) > Scan now. The PC restarts and scans without loading Windows, so persistent malware has a harder time hiding, and the results appear afterwards under Protection history. On a Mac, XProtect removes known malware using updates Apple delivers automatically, so install the latest macOS updates, restart, and delete any app you did not install.
3. Change your passwords from a clean device, such as your phone or another computer, starting with your email account, then banking, then every password the infected computer's browsers had saved.
4. Sign out every session and check your mail rules, as described below.
5. Restore your files from a backup. The NCSC advises restoring from the last backup you know was good, rather than copying files off the infected device and carrying the infection with them. Our guide to recovering deleted files on Windows covers File History, OneDrive and Windows Backup.
6. Reset or reinstall the operating system when you cannot trust the computer (details below).

Run a Microsoft Defender Offline scan

The offline scan is worth the restart. Microsoft says it takes about 15 minutes and runs from outside the normal Windows kernel, so it can reach malware that hides from Windows, such as rootkits that overwrite the master boot record. It needs the Windows Recovery Environment (WinRE) to be enabled; if WinRE is off, the scan does not run and no error appears. Check its status from a terminal opened as administrator:

reagentc /info

Why a new password is not enough

Two things on an infected computer outlive a password change. A keylogger captures whatever you type next, including the new password, which is why you change passwords from another device. And an infostealer takes session cookies as well as saved passwords. A session cookie is the token a site keeps in your browser after you sign in, and a stolen one lets someone use the site as you, without your password, which can get around some multi-factor authentication. After changing a password, the NCSC advises logging out every device and app still signed in to the account, checking your email for forwarding rules you did not create, and turning on two-step verification. Our guide to staying safe online covers passkeys and password managers, which make the next incident smaller.

When to reset or reinstall

Reset or reinstall if the scan cannot remove the malware, if it keeps coming back, if a rootkit was found, if ransomware ran, or if you pasted a command and cannot say what it did. After a rootkit, Microsoft says, you cannot trust anything the device reports about itself.

On Windows, Recovery options offers Reset this PC, which reinstalls Windows and lets you remove everything; for a suspected infection, Microsoft points to reinstalling from installation media created on another working PC, which removes everything from the device. On a Mac, use Erase All Content and Settings in System Settings > General > Transfer or Reset, which erases your data, settings and apps. Reinstalling macOS from Recovery on its own does not remove apps or personal data, so it is not a cleanup. Afterwards, reinstall apps from their official sources and restore your files from the backup. Microsoft notes one limit: malicious code hidden in firmware can survive an operating system reinstall, though it describes such malware as requiring a high level of sophistication.

Protecting the computers in a small business

Everything above applies to a business, with two differences: someone has to confirm that every layer stays on across every device, and one infected laptop can expose shared mailboxes, files and customer data. That calls for central device management, endpoint detection and response (EDR) instead of antivirus alerts that only the person at the keyboard sees, patching on a schedule, and no local administrator rights for daily users. Our small business cybersecurity checklist puts those controls in priority order.

Our IT support service covers endpoint security for small teams: EDR such as Microsoft Defender for Business, patching for operating systems and apps, and removing local admin rights, alongside device management. The websites and servers a business exposes to the internet need a different check, which our security scanning service runs on a schedule, ranking what it finds with, among other signals, CISA's catalogue of known exploited vulnerabilities. More guides on the subject are under security.