Macs have been scanning themselves for malware and trying to remove any they find, for well over a decade. One of the quirks of that protection is its silence. Not only is the user not informed whether or when scans are performed, but if malicious code is found, the user isn’t told, even if its removal fails.

MRT

Until 2022, this task was performed by MRT, Apple’s Malware Removal Tool, whose most public claim to fame was when it was repurposed to remove a vulnerable web server installed by Zoom software. MRT version 1.45, released on 10 July 2019, is thought to have rescued millions of Macs that otherwise could have been exploited through that hidden web server.

As a relatively lightweight malware scanner, MRT ran shortly after a Mac started up, in both its agent and daemon modes. As an app, it could also be run manually, either in agent mode through the Finder, or in Terminal in both modes. This enabled all Macs to scan for malware, even if they were left running continuously for weeks on end.

XProtect Remediator

Although Macs continue to install MRT to this day, it was last updated to version 1.93 on 29 April 2022, and doesn’t appear to be run automatically any more. It has since been replaced by an app calling itself XProtect, commonly qualified as XProtect Remediator (or XPR) to distinguish it from the other XProtect that only scans on demand. In June and July 2022 this gained multiple scanning modules, one of which is a direct replacement for MRT. As XPR can only be installed and run in macOS Catalina and later, that has left earlier versions of macOS with outdated protection, but in return brings more versatile and powerful scanning modules.

Apple remains secretive about what XPR has achieved, but it’s thought to have been able to mitigate a problem that occurred with app notarisations for a period in the past. As its capability has grown, so too have its demands on CPU time and energy. As a result, its daily scans are now cut short by a timer, and only once a week are they all given the time to complete fully.

XPR is run as a scheduled background activity, using the DAS-CTS dispatching system, every 24 hours. Because they’re now so demanding, they won’t be run at all when a laptop isn’t connected to mains power. For many laptop users, that means XPR scans are run infrequently, and may be skipped for many days or weeks. Until recently, this wasn’t such a problem, as, like MRT before it, the XPR app could be run manually in the Finder, or in my utility XProCheck.

Auto only

XPR version 163, released on 18 September 2026, changed that, and can no longer be run by the user. For the first time since the introduction of MRT, macOS no longer provides a malware scanner that can be run manually.

Attempts to run the XProtect app result in silent failure. When run from the Finder, LaunchServices, RunningBoard and all the other subsystems involved in app launch, work as expected, but when it comes down to it, XPR simply refuses to launch or run, so is abandoned as missing presumed dead. The closest the log comes to recording an error is:
0.999074 kernel System Policy: launchservicesd(377) deny(1) signal same-sandbox [XProtect(1430)] signum:19
0.999078 com.apple.launchservices LAUNCH: Failed sending SIGCONT to process 0x0-0x4a04a 1430 com.apple.XProtectFramework.XProtect, errno=1 so waiting a bit and trying again.
The latter entry is repeated until LaunchServices gives the app up as a lost cause.

Reporting

As XPR never reports direct to the user, nor is there anywhere that reports when its last scans were run, it can lull the unwary into a sense of false security. Without resorting to the use of third party software, users can find nothing out about XPR or its scans, other than the version installed.

Records of scans are available from two sources, Endpoint Security events and log entries. Although Endpoint Security is a macOS feature, as far as I’m aware no Apple software exposes its events to the user. It is now becoming widely supported by third-party security products, although they’re inevitably least likely to want to reveal information about Apple’s security protection.

XPR’s log entries are exposed in several of my utilities, including SilentKnight and XProCheck, but are limited by their retention in the log. As XPR scans are only intended to be run once every 24 hours, and log entries may only be retained for shorter periods, it’s common that the most recent scan results have already been removed from the active log when it’s checked by a user. Unless a Mac is run infrequently, it’s unusual for the log to contain entries from more than one set of XPR scans.

The end result is that Macs seldom provide any useful information about their XPR scans, even when they are occurring regularly, every 24 hours.

Conclusions

Although XPR should be a big improvement on MRT, it’s now unreliable on most laptops, and its lack of reporting makes it inferior to third-party substitutes. Particularly on laptops that are run mostly on battery power, XPR scans can occur infrequently and their outcome may be impossible to discover. If you want a more reliable and transparent malware scanner, you’re better off using a third-party product.

Given the engineering effort that has gone into developing XProtect Remediator, this is a great shame.