How to Fix “Cannot Check for Malicious Software” Error on macOS

What Does “Apple Cannot Check It for Malicious Software” Mean?

macOS uses a security technology called Gatekeeper to inspect applications, plug-ins, packages, and other executable software downloaded from outside the Mac App Store. Gatekeeper checks whether the software comes from an identified developer, whether its digital signature remains valid, whether Apple has notarized it, and whether the package appears to have been altered.

Notarization is an automated Apple security process for software distributed outside the App Store. A developer submits a signed app to Apple, where it is scanned for known malicious content and code-signing problems. If it passes, Apple issues a notarization ticket that Gatekeeper can recognize. A notarized app is not magically guaranteed to remain safe forever, but it has cleared an important security checkpoint.

Common reasons the warning appears

• The developer did not sign or notarize the application.
• You downloaded an older build that predates current macOS requirements.
• The app was modified, repackaged, or corrupted after the developer released it.
• The download came from a mirror, advertisement, file-sharing site, or unofficial repository.
• The developer’s certificate was revoked or is no longer valid.
• The app is incompatible with your macOS version or Mac processor.
• A company administrator has restricted unapproved applications.

This message is different from an alert saying an app “will damage your computer” or “contains malware.” When macOS identifies known malicious content, it may block the app and move it to the Trash. Do not use the bypass methods in this article for software that macOS specifically identifies as harmful.

Before You Override macOS Security

Apple explicitly warns that manually overriding security protections is a common way malware reaches a Mac. Before approving an unverified app, confirm that you trust both the developer and the exact file you downloaded. A familiar logo is not proof; malware authors also know how to copy and paste.

Run this quick safety checklist

1. Confirm the website address. Download the app from the developer’s official website, the Mac App Store, or a repository linked directly by the developer.
2. Avoid sponsored download buttons. Search advertisements sometimes lead to imitation pages that distribute modified installers.
3. Check the app’s release date. A program last updated many years ago may not meet modern signing and notarization requirements.
4. Look for a checksum. If the developer publishes a SHA-256 hash, compare it with the downloaded file.
5. Read recent developer notices. The company may already offer a new installer or explain a temporary certificate problem.
6. Scan suspicious files. A reputable malware scanner can provide another layer of inspection, although no scanner can guarantee that a file is harmless.

Recent macOS threats have used fake installers, stolen signing credentials, social engineering, and instructions that persuade users to paste commands into Terminal. That is why a security warning should trigger verification, not a reflexive search for the fastest bypass.

How to Fix the “Cannot Check for Malicious Software” Error

1. Download the newest version from the official developer

The safest fix is often the simplest: delete the questionable copy and download the latest release directly from the developer. An older app may have been signed with an expired certificate or packaged before Apple made notarization a default requirement.

1. Quit the app and close its installer.
2. Move the downloaded app, ZIP file, DMG, or PKG file to the Trash.
3. Empty the Trash only after confirming that you do not need the file.
4. Visit the developer’s official download page.
5. Download the current macOS version and try again.

If the developer offers both Intel and Apple silicon editions, choose the correct build for your Mac. Universal apps support both architectures. An architecture mismatch normally produces a different error, but selecting the proper version can prevent additional installation problems after Gatekeeper approval.

2. Check the Mac App Store

Search for the application in the Mac App Store. Apps distributed there are reviewed and signed through Apple’s store process, making this the safest installation route. Apple recommends looking for an App Store version or an alternative application before overriding the warning.

Be careful with apps that have similar names. Confirm the developer name, icon, description, reviews, and official website before installing.

3. Move the app to the Applications folder

Some apps do not behave correctly when launched directly from a disk image, temporary folder, or compressed archive. Fully extract the download and move the application before opening it:

1. Open the downloaded DMG or ZIP file.
2. Drag the app into the Applications folder.
3. Eject the disk image if one was mounted.
4. Open Finder and select Applications.
5. Try launching the copied app.

Moving an app into Applications does not make unsafe software safe, but it prevents temporary paths and incomplete extraction from complicating the installation. App translocation and randomized launch locations can also affect applications that expect to run from a permanent folder.

4. Use Privacy & Security to open a trusted app

When you are confident that the app is legitimate and has not been altered, use Apple’s per-app override instead of disabling Gatekeeper globally.

1. Try to open the app once so the warning appears.
2. Close the warning dialog.
3. Open the Apple menu and select System Settings.
4. Choose Privacy & Security.
5. Scroll down to the Security section.
6. Find the message explaining that the app was blocked.
7. Click Open Anyway.
8. Enter your Mac login password or use Touch ID.
9. Review the warning again and click Open only when you remain certain about the file.

The Open Anyway button is generally available for about one hour after you attempt to launch the blocked app. After approval, macOS saves that application as an exception, allowing it to open normally in the future.

5. Do not rely on Control-click in newer macOS versions

Older Mac guides often recommend Control-clicking an app, selecting Open, and approving it from the shortcut menu. That approach may still work in some older releases, but Apple tightened the process beginning with macOS Sequoia. Software that is not properly signed or notarized must generally be reviewed through System Settings > Privacy & Security instead.

If Control-click does not display an Open option, your mouse is not broken and Finder has not developed a personal grudge. Use the Privacy & Security method above.

6. Allow apps from identified developers

Your Mac may be configured to accept only Mac App Store software. To review the setting:

1. Open System Settings.
2. Select Privacy & Security.
3. Scroll to the Security section.
4. Under Allow applications downloaded from, select App Store and identified developers.

This option still keeps Gatekeeper active. It does not automatically approve unsigned or unnotarized apps, but it allows properly signed software from developers registered with Apple. The setting may be unavailable on a Mac managed by an employer, school, or device-management administrator.

7. Update macOS

Install available macOS updates before attempting more aggressive fixes. Updates can refresh security components, certificates, compatibility data, and built-in malware protections.

1. Open System Settings.
2. Select General.
3. Click Software Update.
4. Install available updates and restart your Mac.

Save your work and create a backup before installing a major macOS upgrade. Updating does not convert an untrusted program into a trusted one, but it eliminates system bugs and outdated security information as possible causes.

8. Delete a damaged installer and download it again

If the warning changes to say the app is damaged or cannot be verified, the download may be incomplete or corrupted. Delete it and obtain a fresh copy. Apple gives similar advice for macOS installers that are reported as damaged or unverifiable.

Repeated corruption can point to an unstable internet connection, a failing storage device, an overenthusiastic cleanup utility, or a third-party security product interfering with downloads. Try another trusted network and temporarily pause only the specific tool known to be interfering. Re-enable it immediately afterward.

9. Check the app with Terminal before removing quarantine

Advanced users can ask Gatekeeper to assess an application. Replace App Name.app with the real name:

You can also inspect whether the app has a quarantine attribute:

A quarantine attribute is normal for software downloaded from the internet. It tells macOS to perform security checks when the file is opened.

10. Remove the quarantine attribute only as a last resort

If you created the app yourself, obtained it from a thoroughly verified source, or are working with trusted legacy software that cannot be notarized, you can remove the quarantine attribute:

This command does not scan the app, repair its signature, or prove that it is safe. It removes the marker that triggers important macOS checks. Verify the path carefully because the recursive option applies the change throughout the application bundle.

Do not paste Terminal commands supplied by random pop-ups, videos, advertisements, support impostors, or unfamiliar websites. Modern macOS malware campaigns frequently depend on persuading users to execute commands manually, effectively asking the victim to install the threat on the attacker’s behalf.

11. Avoid disabling Gatekeeper globally

Some outdated tutorials recommend commands that turn off Gatekeeper for every application. Avoid this approach. A single-app exception limits the risk to software you deliberately reviewed, while a global disable weakens protection for future downloads as well.

Gatekeeper remains an important layer in macOS security even though no security control is perfect. Researchers have documented attempts to bypass it, which is an argument for keeping it enablednot for firing the bouncer and letting everybody into the club.

12. Contact the developer or your IT administrator

Contact the developer when the official installer continues to trigger the warning. Ask whether the current release is signed, notarized, and compatible with your macOS version. A responsible developer should provide a corrected package rather than tell every customer to disable security.

On a work or school Mac, contact IT. Device-management policies may intentionally prevent users from approving unauthorized applications. Attempting to bypass those controls could violate organizational policy and may still fail because the restriction is enforced centrally.

When You Should Not Open the App

Stop troubleshooting and delete the file when any of the following applies:

• The download came from a crack, torrent, pirated-software site, or unsolicited message.
• The installer asks you to disable Gatekeeper, System Integrity Protection, antivirus protection, or automatic updates.
• A website tells you to paste a long encoded command into Terminal.
• The app impersonates an Apple utility or well-known product but came from an unrelated domain.
• macOS says the app will damage your computer or contains malware.
• The developer cannot confirm the file is authentic.
• The app requests an administrator password without a convincing reason.

Notarization, code signing, antivirus scanning, and Gatekeeper all reduce risk, but none replaces careful sourcing. Security researchers continue to find malicious software that abuses trusted platforms, stolen certificates, deceptive installers, and user-approved commands.

Frequently Asked Questions

Does the warning mean the app is definitely malware?

No. It means macOS cannot complete the trust checks required to approve the software automatically. The app may be harmless but outdated, unsigned, improperly packaged, or unnotarized. It may also be malicious, so verify it before proceeding.

Is clicking Open Anyway safe?

It is reasonable only when you have verified the developer, download source, file version, and authenticity. Open Anyway creates an exception for that app; it is not a safety certificate.

Why is the Open Anyway button missing?

Try launching the app again, then immediately return to Privacy & Security. The button normally appears for a limited period. It may also be unavailable when the software is known malware, badly damaged, completely unsigned under stricter policies, or blocked by device management.

Will reinstalling the app fix the error?

Reinstalling helps when the original file was corrupted, outdated, or downloaded from an unofficial source. Reinstalling the same unnotarized build from the same location usually produces the same warning.

Can antivirus software fix the Gatekeeper warning?

An antivirus scanner may provide additional information about the file, but it does not notarize an app or repair an invalid developer signature. The permanent fix must usually come from the developer.

Practical Experiences and Lessons from Fixing This macOS Error

Common troubleshooting cases reveal that the fastest solution is not always the most technical one. In many situations, users spend half an hour experimenting with Terminal only to discover that they downloaded a five-year-old installer from a third-party archive. Replacing it with the current release from the developer’s website resolves the warning immediately. The lesson is wonderfully unglamorous: verify the download before attempting digital surgery.

One recurring example involves open-source utilities hosted on repository platforms. The source code may be legitimate, but an unofficial site can repackage the compiled application with advertising software or unwanted components. Users see the familiar project name and assume the file is identical. Checking the project’s official release page, developer identity, release date, and published checksum often exposes the difference. A recognizable name is useful; a verifiable chain of distribution is better.

Audio professionals frequently encounter the warning with older plug-ins and virtual instruments. These products may still work perfectly, but their installers were created before modern notarization rules. The safest outcome usually comes from requesting an updated installer from the vendor. When no update exists, experienced users test the software on a noncritical Mac, keep a complete backup, confirm that the plug-in came from the original vendor, and approve only that specific item. They do not disable Gatekeeper for the entire system just to make one vintage compressor plug-in feel young again.

Another common case occurs after migrating data to a new Mac. An application copied from an old computer may carry outdated components, broken helper tools, or an invalid signature. Downloading a clean, current installer is usually more reliable than dragging the old app bundle between machines. This is especially important when moving from an Intel Mac to Apple silicon, where an old app may also require Rosetta or an architecture-compatible replacement.

Managed workplace Macs provide a different lesson. Users may follow every online instruction and still find that Open Anyway never appears. The missing button is sometimes intentional: the organization has restricted unapproved software through mobile device management. In that situation, contacting IT is not surrender. It is the correct fix. The administrator may already have an approved version, a managed installation package, or a safer alternative.

The most valuable experience-based rule is to pay attention to what an installer asks you to do. Legitimate specialist software may require accessibility access, Full Disk Access, system extensions, or an administrator password, but the developer should clearly explain why. A download that demands several security changes before displaying a normal interface deserves extra scrutiny. When an app instructs you to disable multiple protections, paste commands into Terminal, and ignore every warning, it is no longer troubleshootingit is auditioning for the role of malware.

Finally, keep recovery options ready. A current Time Machine backup transforms a risky experiment into a manageable problem. Without a backup, even a legitimate but poorly designed legacy installer can create hours of cleanup. The best troubleshooting habit is therefore not memorizing a magical command. It is combining trusted downloads, current software, targeted exceptions, healthy skepticism, and reliable backups.

Conclusion

The “Cannot check for malicious software” error is a protective macOS warning, not an inconvenience to defeat at any cost. Begin by downloading the newest version from the official developer or Mac App Store. Move the app into Applications, update macOS, and use Privacy & Security > Open Anyway only after verifying the file.

Terminal-based quarantine removal should remain a last resort for software you can independently confirm is trustworthy. Never bypass an alert saying an app will damage your computer, and avoid globally disabling Gatekeeper. The goal is not merely to make the application open; it is to open it without turning your Mac into a suspicious-software bed-and-breakfast.