How do I ensure my Mac is secure after downloading a potentially malicious app?

There is an active malware campaign on GitHub where fake repositories impersonate real open-source apps (like MacYTDL, LastPass, or Audacity). These malicious clones are explicitly designed to fail or crash upon launch, triggering a fake or real system prompt to trick you into entering your admin passcode. If you entered your passcode, the malware may have granted itself deep, administrative privileges to install persistent background scripts or steal credentials. 

To completely ensure your Mac is secure, follow this verification and cleanup checklist.

Run a TRUSTED Malware Scan (see below for more info on 'CleanMyMac', etc.)

Download the free version of Malwarebytes for Mac.

Malwarebytes has excellent threat intelligence and specializes in tracking these exact GitHub-based Mac malware strains.

1. Download and install Malwarebytes.
2. Run a full system scan.
3. If it flags any items (often labeled as Trojans, Adware, or Agents), allow the app to quarantine and delete them.

Audit Background Items and Launch Daemons

Persistent malware hides by forcing itself to start every time your Mac boots up. You should manually check for leftover files:

• Open System Settings > General > Login Items & Extensions.
• Look closely at the Allow in the Background list. Turn off anything unfamiliar or any background process related to "MacYTDL" or unverified developers.
• Open Finder, press Command + Shift + G to bring up the "Go to Folder" box, and check these three specific directories:
  • /Library/LaunchAgents
  • /Library/LaunchDaemons
  • ~/Library/LaunchAgents (Note the tilde ~ symbol for the user folder)
• If you see any recent files inside those folders created yesterday that look suspicious or reference the failed app, move them to the Trash and empty it.

Change Your Passwords and Secure Your Accounts

Because the app explicitly asked for your passcode and crashed: 

• Change your Mac login password: Go to System Settings > Users & Groups and update your passcode immediately.
• Update your critical passwords: If you store passwords in your browser or an unencrypted app, use a secondary device (like your phone) to change passwords for highly sensitive accounts—especially your Apple Account, primary email, and online banking.
• Check your browser extensions: Open your web browsers and remove any extensions you don’t recognize that might have been quietly installed. 

Moving Forward: How to Stay Safe

• Look out for Gatekeeper overrides: macOS includes built-in defenses like Gatekeeper and XProtect to scan apps. If you ever double-click a downloaded app and your Mac blocks it with a warning, do not force it open via the "Open Anyway" setting unless you are 100% confident in the source. 
• Avoid searching for utility apps directly on GitHub: Malicious actors use search engine optimization (SEO) to push fake GitHub repositories to the top of Google search results. Always navigate to an open-source project from its official home website.

MacOS is very effective at protecting the user against viruses and malware, but it cannot protect you from yourself.

IMO, it's unfortunate that you chose to use CleanMyMac. Long-time forum members refer to it unaffectionately as BrickMyMac because we have seen all the problems it causes over the years. 3rd party ‘protection’ softwarincludes:

• Cleaners (software claiming to automatically free up space)
• Optimizers (software claiming to make your Mac run faster)
• Antivirus software
• VPN software (unless provided by a school/employer to enable access to internal resources from a remote location)

Such 3rd party system ‘helpers’, ‘cleaners’ and ‘protectors’ do more harm than good (Malwarebytes is pretty much the only exception, and I have no personal experience with it because I've never been duped into permitting malware to install itself on my Macs). In fact, such products are completely unnecessary for macOS and the only ‘good’ (if you want to call it that) they do is to put money in the developers’ pockets. Cleaners and protectors cause compatibility issues, often after macOS updates. Commercial VPNs claim to hide your browsing activity from websites, and while that may be true those VPN providers just sell your browsing data to others. For the user, all of these types of software offer only harm…and if that is limited to harm to your bank account, then count yourself lucky. If you have installed such software, follow the developer’s instructions to completely uninstall it (note that some developers fail to provide instructions and their software installs can be pervasive, meaning the only way to truly remove it is to erase your Mac, reinstall macOS then restore your user files from a backup).

macOS has several built-in security protections, but it is important to understand both their strengths and their limitations.

Windows-like viruses that self-replicate and spread automatically are not the only form of malware. macOS can be affected by adware, trojans, information stealers, and other malicious software. Its UNIX foundation, permission model, and security architecture provide important defences, but they do not make it immune to malware.

Apple's documentation explains some of these protections:

• Signed system volume security

• macOS app security enhancements

• Protecting against malware in macOS

• Effective defenses against malware and other threats

An important distinction: the sealed system volume protects the integrity of core macOS system files.

It does not protect every file on the Mac.

The writable Data volume includes the user's Home folder, third-party applications, application support files, preferences, and other data.

Malware or a poorly behaving utility can affect these locations without modifying the sealed system volume.

Adware and malware are frequently distributed through deceptive downloads, compromised websites, impersonated applications, and untrustworthy developers. A download hosted on GitHub is not automatically safe merely because GitHub is a legitimate platform.

Source: Apple Support Communities user tip by Kurt Lang:

Effective defenses against malware and other threats

Regarding CleanMyMac

I would exercise caution when using third-party cleaning and maintenance utilities, particularly those that modify permissions, remove system or application files, or make broad changes to the user's account.

Apple Support Communities contains reports from users who attribute application, Finder, settings, and other problems to CleanMyMac. You can review the discussions here:

Apple Support Communities — CleanMyMac search results

Some reported problems involve files and components located in the user's Home folder and Library directories.

These locations are writable and are not protected by the sealed system volume in the same way as core macOS system files.

The existence of these reports does not establish that every installation of CleanMyMac will cause damage.

However, reports of serious or persistent problems should not simply be dismissed on the grounds that macOS has a sealed system volume.

What if a Mac's integrity has been compromised?

If there is credible evidence that an installation or user account has been damaged, and the cause cannot be reliably identified or reversed, I would consider a clean installation of macOS rather than continuing to troubleshoot an untrusted environment indefinitely.

Apple provides instructions here:

How to erase a Mac with Apple silicon

After erasing the Mac, reinstall macOS and reinstall applications from the Mac App Store or the verified websites of their respective developers. Restore personal documents selectively from a known-good backup. Avoid blindly restoring applications, utilities, settings, or other components that could reintroduce the original problem.

A clean installation is a conservative recovery measure, not a requirement for every suspicious download or every reported application problem.

Returning to the original question about MacYTDL

The fact that MacYTDL bounced once in the Dock and crashed does not establish whether it was malicious or whether it successfully compromised the Mac. The request for a passcode is worth investigating, particularly if the prompt was unexpected or the user entered their credentials.

I would recommend updating macOS, reviewing Login Items and granted privacy permissions, and running a second-opinion scan with a reputable security product such as Malwarebytes for Mac. If there is evidence of credential theft or persistent compromise, additional remediation may be necessary.

Apple's built-in defences are valuable, but no operating system or antivirus product can guarantee complete protection. The objective is to assess the evidence, take proportionate precautions, and avoid assuming either that the Mac is definitely compromised or that it is definitely safe simply because the suspicious application has been deleted.

I have completed the malwarebytes check and it says no threats detected.

No threats, ok. There is literally nothing, no product that can definitively confirm the absence of malware. It is logically impossible. Don't bother looking for one. As far as "Malwarebytes" or any similarly categorized product is concerned I'd trust it about as much as I could throw it.

I do have a backup dating from before I downloaded it.

That's the best news. Restoring that Time Machine backup is the right thing to do, and will obviate the necessity to erase the Mac.

Instructions: Restore your Mac from a backup - Apple Support

If it is in fact a virus, ...

There are none. Zero. The reason for that important distinction is that you must avoid seeking an "anti-virus" solution to a problem that does not exist. All such things are scams that will result in misery.

I will take the liberty of restating that question as "if in fact it was malware". Restoring the TM backup will obviate that concern.

The only remaining concern would be the possibility you provided confidential information to the (real or fake) "MacYTDL" app. The way to address that concern is to change any passwords / passcodes / other information you may have provided to something unknown.

Apple's Personal Safety User Guide is a valuable and comprehensive resource that will guide you toward that end.

As for your Mac itself, the fact you had the forethought to use Time Machine will now prove its worth.

macbookguy12 wrote:

I have deleted the app now, and checked into library cache to see if there were any files left from that app and there were none.

If it was indeed virus, did it just steal all of my data at and now finished or it is constantly leaking my data?

I feel like my Mac has not slowed down or anything, no weird behaviour or anything.

Can this affect my iPhone and other iCloud connected devices?

This can't be a virus, those cannot function as viruses on the macOS read-only sealed macOS system volume. But you could have downloaded malware. And since you did provide your passcode, what might that have enabled:

possibly ... copying your iCloud data to somewhere else, or changing it, if you have iCloud active and mounted. And that could affect the iPhone and other iCloud devices that also have (had) that data.

possibly ... opening your Passwords or Keychain and send those contents to somewhere else (using the passcode that you entered)

What would I do if this was me or a family member who did this? I would do what MrHoffman suggests below, namely wipe the drive and (restore) migrate from a backup made prior to the download. Then I would change all passwords for Mac, Apple ID, financial/bank logins, and any other web site logins that matter to you. Any that have your credit card saved. I would also change your router login and password for your WiFi.

Is this overkill? Maybe. Others have indicated that they think you are "okay" if you downloaded from the official GitHub site. But you seem to not be totally clear about what exactly you did, you do say "And yes, I had in fact provided my passcode" but do you know for sure from where you downloaded this?

Anyway, that is what I would do. It isn't that different from what one does when one gets a new Mac and has to migrate from a backup. One silver lining: if you migrate back only files, you will then reinstall your apps, choosing to reinstall only apps that are valuable to you or that you actively use. This cleans out old stuff and you may find your Mac runs faster than it did before.

I would also start to be fairly cautious and circumspect about where you download from, going forward.

MrHoffman wrote:

Wipe the Mac and restore your backup from prior to the download, and change your passwords.

Leaning on add-on anti-malware apps seems perilous at best, when looking for unknown apps and potential backdoors.

macbookguy12 wrote:

What if the Malwarebytes didn't detect anything?

if this is the real distro, it’s likely fine. If it is who-knows-what from who-knows-where, roll in backups.

As for using malware scanners to find backdoors, I wouldn’t expect that to be at all useful. Why would a malware scanner find a web service or a changed password or a new service, or other tweaks intended to allow re-access?

Am I to infer you might have no backups? If you have no backups, go fix that Right Now.

Wipe the Mac and restore your backup from prior to the download, and change your passwords.

Leaning on add-on anti-malware apps seems perilous at best, when looking for unknown apps and potential backdoors.

macbookguy12 wrote:

I saw on reddit that on GitHub there was fake downloads for apps that would pretend to be real but would only infiltrate your Mac.

Those are called "Trojans" and they're nothing new.

I downloaded MacYTDL from there yesterday, and it just completely ended up not working, app would jump once on dock and crash, and it asked for my passcode. I have it deleted now, but I am still frightened that my Mac might have possibly been infiltrated? I ran the CleanMyMac antivirus scam but I would like a second antivirus if possible just for double check.

There are no viruses that affect macOS so just forget that idea.

Unfortunately you made a very ill-advised decision to download and install a worthless "cleaning" product that can manifest in problems now or in the future. Depending on exactly what you did with "CleanMyMac" it may be necessary to completely erase the Mac and rebuild it from the ground up. I do not know if "CleanMyMac antivirus scam" was written intentionally or not. It is accurate though.

Rule 1 of Macs is don't install junk.

You may in fact have installed malware in whatever "MacYTDL" might be (seems to me it's a video download product intended to circumvent copyright protection i.e. violate the law, but that is based only on a cursory read) but if all it did was crash then it didn't harm anything.

You wrote that it asked for your passcode, but did you in fact provide it, or other confidential information? A request for confidential information should never come as a surprise. Your answer is important.

I implore you to familiarize yourself with Effective defenses against malware and other threats - Apple Community. Although macOS itself is impervious to malicious interference, there is little that can prevent a determined user from installing malware.

macbookguy12 wrote:

I saw on reddit that on GitHub there was fake downloads for apps that would pretend to be real but would only infiltrate your Mac. I downloaded MacYTDL from there yesterday

Where is "there"? Did you download it from the official repository: https://github.com/section83/macytdl

The (official) app is signed and notarized. And the developer has even posted here.

If you downloaded it from anywhere else, then you might have a problem. But if you downloaded from the official site, then you should be fine. Nothing to worry about.

it just completely ended up not working, app would jump once on dock and crash, and it asked for my passcode.

Well, it is made with AppleScript. 😄

I have it deleted now, but I am still frightened that my Mac might have possibly been infiltrated? I ran the CleanMyMac antivirus scam but I would like a second antivirus if possible just for double check. Which one should I pick? Am I worrying too much?

As long as you downloaded from the official repository, then you're worrying too much.

But if you did download something malicious, then I wouldn't trust any 3rd party antivirus to find it. Let's just hope you didn't do that.

I have completed the malwarebytes check and it says no threats detected. Is it ok and fine now or I still have to change all of my passwords and reinstall macOS? And yes, I had in fact provided my passcode. That was yesterday I had deleted it after. But I had put my passcode before it crashed, I think. But no other confidential information. I went back on the link on gitbuhb, and there was releases dating back to 2019. So maybe it is the real one?

It is possible I have downloaded the real one and non malware infected and still crashed?

I do have a backup dating from before I downloaded it.

If it is in fact a virus, would I need to delete all of my accounts and rebuilt my digital life or just changing the passwords would be ok? What about iCloud?

I have deleted the app now, and checked into library cache to see if there were any files left from that app and there were none.

If it was indeed virus, did it just steal all of my data at and now finished or it is constantly leaking my data?

I feel like my Mac has not slowed down or anything, no weird behaviour or anything.

Can this affect my iPhone and other iCloud connected devices?

What if the Malwarebytes didn't detect anything?

Thank you all for the responses, I have wiped my Mac and used my backup to restore it.