Ran a Suspicious Script on Mac? Check and Lock It Down

By Game Osborne · September 8, 2026 · Mac · Mac security, malware, suspicious script

Follow these calm, beginner-friendly checks to find unwanted changes, protect exposed accounts, and make your Mac safe again.

First, contain the problem

Take a breath. Running a strange script does not automatically mean your Mac is ruined. A script is simply a list of commands. It may have done nothing, or it may have changed settings, copied information, or installed something that starts automatically.

These instructions assume macOS Ventura or later. Menu names can vary slightly between versions. Use the search box in System Settings if you cannot find a named setting.

1. Turn off Wi-Fi from the Control Center in the top-right corner of the screen.
2. Unplug any Ethernet cable connected to your Mac.
3. Write down what you ran, where you found it, and whether macOS asked for your password.
4. Take a photo of any warning or error message still visible on the screen.

Check for programs that now start automatically

A common trick is persistence. That means arranging for unwanted software to return whenever you sign in. Login Items is the safest place to begin looking.

Do not remove something merely because its name is unfamiliar. Search the name online first, or ask a trusted technician. Helpers for printers, cloud storage, password managers, and antivirus software can all appear here legitimately.

1. Reconnect to Wi-Fi only when you are ready to perform the checks below.
2. Open System Settings and search for “Login Items.”
3. Look for an item you do not recognize in the Open at Login list.
4. Remove a confirmed unwanted item by selecting it and clicking the minus button.
5. Turn off a confirmed unwanted entry under Allow in the Background.
6. Open System Settings and search for “Users & Groups.”
7. Check the user list for an account you did not create.

Look for altered security settings

Some scripts ask for an administrator password. That password gives them permission to make deeper changes. Pay extra attention if you typed it.

A configuration profile is a package of settings that can control parts of a Mac. Profiles are normal on work and school computers, but unexpected ones on a personal Mac deserve investigation.

1. Open System Settings and search for “Profiles.”
2. Inspect any listed profile for an organization or name you do not recognize.
3. Remove only a profile you are certain does not belong on the Mac.
4. Search System Settings for “Privacy & Security.”
5. Review Accessibility for an unfamiliar app with permission to control the Mac.
6. Review Full Disk Access for an unfamiliar app allowed to read protected files.
7. Review Screen Recording for an unfamiliar app allowed to view the screen.
8. Turn off access for any app you have confirmed is unwanted.

Check apps, browsers, and Shortcuts

Finder can help you spot a newly installed application. Browser extensions also matter because they may read or alter webpages.

If the suspicious item was an Apple Shortcut, treat it carefully. Apple warns against running shortcuts containing untrusted JavaScript. A webpage shortcut may be able to reach sensitive information displayed on that page, including passwords, phone numbers, and payment details.

1. Open Finder and select Applications in the sidebar.
2. Switch the Applications folder to List view.
3. Sort the Applications list by Date Added.
4. Move a confirmed unwanted application to the Trash.
5. Open your web browser’s Extensions or Add-ons settings.
6. Remove any extension installed at the time of the incident that you do not trust.
7. Open the Shortcuts app if the suspicious script was delivered as a shortcut.
8. Delete the untrusted shortcut from your Shortcuts library.
9. Choose Shortcuts > Settings from the menu bar.
10. Turn off Allow Running Scripts in the Advanced tab if you do not intentionally use scripted shortcuts.

Scan, update, and protect your accounts

macOS includes security protections that work in the background, but there is no single screen that proves a script changed nothing. Updating macOS gives those protections the newest available system fixes.

If the script came from a scam page, avoid downloading a “cleanup tool” advertised on that same page. If you use a malware scanner, obtain it directly from a well-known security company’s official website.

Assume a password may be exposed if you typed it into the suspicious script, pasted it into Terminal, or had it visible on a webpage that an untrusted Shortcut was allowed to access. Change important passwords from another trusted device when possible.

1. Open System Settings and choose General > Software Update.
2. Install any available macOS update.
3. Run a scan with a reputable Mac security app downloaded from its official developer website.
4. Change your Apple Account password from a trusted device.
5. Change the password for your primary email account.
6. Change every password that you typed or pasted while the suspicious script was running.
7. Enable two-factor authentication on important accounts that offer it.
8. Empty the Trash after you are certain it contains only unwanted files.
9. Restart the Mac.

When to get expert help

Stop using the Mac for banking or sensitive work if an unknown administrator account returns, removed login items reappear, security settings change by themselves, or the script had your administrator password. Those signs can point to deeper changes that ordinary settings screens will not reveal.

A technician may recommend backing up personal documents and reinstalling macOS. That sounds dramatic, but it is the cleanest answer when a powerful script is known to be malicious. Avoid restoring unknown applications or system files afterward.

1. Contact a trusted Mac technician if suspicious items return after the restart.

Bottom line

Check startup items, accounts, profiles, permissions, applications, browser extensions, and Shortcuts before changing exposed passwords. If unwanted changes return or the script received your administrator password, stop handling sensitive data and get the Mac professionally checked.