[ bitsandbytes presents ]
A malware scanner for macOS. It looks at what starts by itself, your apps, your browser extensions and the places downloads land, checks every program it finds against Apple’s XProtect rules, and tells you plainly what it found. Anything bad goes to a quarantine you can undo. It scans when you ask, rather than watching all the time: read what it can’t do before you rely on it.
Give it Full Disk Access once, so macOS doesn't keep Mail, Messages, Safari and some browsers' extensions out of sight.
A quick scan in about a minute, or a full one of every program and script on the Mac, from the window or the menu bar.
Known malware goes to quarantine, which you can undo. Anything only worth a look, you can say is fine, and it's remembered.
[ what it does ]
The same XProtect rules macOS uses, read from your Mac each time, so they're as current as your last macOS update and are never copied or shipped. MacWarden adds its own on top: today, just the EICAR test file, so you can see it working.
Every launch agent and daemon, for you, for everyone and at boot, and the program each one runs. This is where most Mac malware makes sure it keeps running.
Each app's signature: Apple, the App Store, a named developer, or nobody. And whether it has changed since it was signed, which is what tampering looks like.
Browser extensions installed from outside the store in Chrome, Edge, Brave, Arc, Vivaldi, Opera and Chromium, and configuration profiles, which adware uses to take over settings.
Downloads, the Desktop and the hiding places droppers use. A full scan adds every program and script in your home folder, your apps and the system library. Files in iCloud or other cloud storage are never downloaded just to check them.
Moving something to quarantine stops a startup item first, then puts it out of the way. Put it back at any time. Things the system owns are moved with your password, through macOS's own prompt.
Something you know about is remembered by its fingerprint, so it isn't flagged again, unless it changes, when it's looked at afresh.
Close the window and the shield stays: start a scan, leave it running, and see how many things are worth a look beside it. Nothing leaves your Mac; MacWarden makes no network connections.
[ what it can't do ]
MacWarden is an honest second look, not an antivirus that guards the Mac around the clock:
MacWarden only looks when you scan. It doesn't stop malware arriving or running in between; macOS's own XProtect and Gatekeeper still do that job, and MacWarden is a second look, not a replacement for keeping macOS up to date.
Something is called malware only when it matches a rule. Something too new for Apple's rules won't be named. "Worth a look" means unusual in the ways malware often is, such as an unsigned script that starts at login. It is a hint, not a verdict.
Even with Full Disk Access, macOS keeps a few folders out of reach of every app, and MacWarden says how many it couldn't look inside. Firefox's extensions aren't checked yet.
A malware scanner that asks you to click past Gatekeeper is a fair thing to be wary of. It is signed without a paid Apple certificate, so macOS can't vouch for it, and for the same reason Full Disk Access has to be given again after each update.
The aim is a version that checks programs as they start and files as they arrive, and stops known malware before it runs. That needs Apple’s Endpoint Security, a paid developer certificate and Apple’s approval, so there is no date yet. The scanner will stay free.
[ in the app ]
[ installing ]
The first time only, macOS needs telling that MacWarden is allowed, and that it may look everywhere.
Open MacWarden.dmg and drag MacWarden onto the Applications folder beside it.
Double-click MacWarden in Applications. macOS says it can't check it for malicious software, because it isn't signed with a paid Apple certificate. Choose Done, not Move to Bin.
System Settings → Privacy & Security, scroll down to Security, and click Open Anyway beside MacWarden. Confirm with Touch ID or your password, then Open.
Click Open Full Disk Access settings on MacWarden's home screen, turn MacWarden on, and choose Quit & Reopen. MacWarden only ever reads what this lets it see.
Or, if you're happy in the Terminal, this does steps 2 and 3 in one go:
xattr -dr com.apple.quarantine /Applications/MacWarden.app
[ questions ]
Yes. No account, no trial, no subscription, and no upsell inside the app.
XProtect checks apps when they are first opened, and its background scans run quietly and rarely tell you anything. MacWarden runs the same rules over everything at once, including startup items, extensions and profiles nobody has opened lately, explains what it finds, and adds checks rules can't: who signed each app, whether it has been changed since, and what starts by itself.
A good question to ask of anything. MacWarden makes no network connections, changes nothing without asking, and every move it makes can be undone from Quarantine. It reads Apple's rules from your Mac rather than shipping its own copy. A paid Apple certificate, so macOS can vouch for it, is hoped for.
Choose It's fine and it won't be flagged again unless it changes. Plenty of honest software is unsigned or starts a script at login (developer tools, GPG, home-made automations), which is exactly why those are worth a look rather than malware.
MacWarden only offers it for startup items, apps and files. A quarantined startup item is stopped first, and anything can be put back exactly where it was from the Quarantine page. Delete for good is a separate, second step.
Download the EICAR test file from eicar.org, the harmless file every antivirus recognises, into your Downloads folder and run a quick scan. MacWarden will call it known malware. Delete it afterwards.
macOS ties the permission to the exact copy of an app that isn't signed with a paid certificate. Remove MacWarden from the Full Disk Access list in System Settings and add the new copy.
Choose Quit MacWarden from the shield in the menu bar, put back or delete anything in Quarantine first, drag MacWarden from Applications to the Bin, and delete the folder uk.bitsandbytes.macwarden from ~/Library/Application Support.
macOS 14 Sonoma and later, on Apple silicon or Intel. One download covers both.
It is free because it was written for one Mac and there is no reason it should not run on yours. If it finds something nasty, there is a coffee button at the top of the page.