Start your 3-day free trial
Sign up to experience all premium features at no cost.
*Available only to new users. Each user is limited to one trial.
What “Apple Cannot Check It for Malicious Software” Means
Kevin Wu
August 27, 2026· Updated October 4, 2026· 8 min read
The macOS message “Apple cannot check it for malicious software” means Gatekeeper could not complete the trust checks normally used for software obtained outside the App Store. It is not proof that the app is malware, but it is also not a harmless prompt to click through. Apple says unsigned or unnotarized software may expose the Mac and personal information to malware.［1］
Key Takeaways
- Stop and verify the developer, download page, file integrity, and purpose.
- Prefer the App Store or the developer’s official, current distribution.
- Do not use Terminal commands or blanket security changes as the default fix.
- Override only for a specific app you are certain is trustworthy and unaltered.
Apply the evidence-first sequence in Device and App Troubleshooting Guide. The goal is not merely to launch the file; it is to decide whether the file should run.
What is Gatekeeper checking?
Apple explains that, by default in macOS 10.15 or later, Mac apps must be notarized by Apple to launch, which helps ensure that software from outside the App Store is free of known malware.［2］ Gatekeeper verifies that the software comes from an identified developer, is notarized, and has not been altered.［3］
These signals answer different questions:
| Signal | What it helps establish | What it does not prove |
|---|---|---|
| Official developer page | Where you intended to get the app | That a compromised page or file is safe |
| Developer ID signature | The app is signed by an identified developer | That every behavior is desirable |
| Notarization | Apple scanned the submitted software and issued a ticket | That no future or hidden risk exists |
| Malware warning | macOS recognized a serious threat signal | That deleting one file fixes every effect |
| Check unavailable | Normal verification did not complete | That the app is safe or malicious |
Gatekeeper is one layer. It does not replace source verification, least privilege, updates, backups, or careful review of what an app requests.
Why might “Apple cannot check it for malicious software” appear?
Common possibilities include:
- the developer did not sign or notarize the app;
- you downloaded an old build created before current requirements;
- the archive or app was modified after signing;
- the file came through a mirror, repackage site, message, or ad;
- the developer’s certificate or notarization status changed;
- macOS could not complete an online check.
Do not assume a network error is the cause. First compare the exact alert wording and app name with Apple’s current support page. Alerts that say an app “will damage your computer,” “is damaged,” or contains malware represent different and potentially more serious situations.［1］
How do you verify a Mac app before opening it?
- Cancel the launch and keep the app closed.
- Confirm you actually need the software and know what it should do.
- Find the developer’s official site independently, not through the alert or an advertisement.
- Look for an App Store version or a newer notarized build.
- Compare the file name, version, platform, size, and any published checksum or signature.
- Confirm the download used HTTPS and came directly from the stated publisher.
- Review the developer’s reputation, update history, support details, and requested permissions.
- Back up important data before running unfamiliar system-level software.
A checksum only proves that your file matches the checksum you obtained. If both came from the same compromised page, it does not create independent trust. Prefer a signature or checksum published through a separate, well-established developer channel.
What should you do if the source is uncertain?
Delete the download and obtain a fresh copy from the App Store or the developer’s official page. If the developer offers no current signed build, contact them. Apple’s guidance for the “cannot check” alert recommends looking for a newer version in the App Store or from an alternative source, or contacting the developer.［1］
Do not search for a command that removes quarantine metadata, disables Gatekeeper, or suppresses checks across the Mac. Such commands change the security boundary without establishing that the app is genuine.
If the app arrived through a pirated bundle, unofficial “crack,” unsolicited message, search ad, or unknown mirror, do not override the warning. Remove it and scan the Mac with current built-in protections and any approved organizational security tool.
When is it reasonable to use Open Anyway on a Mac?
Apple provides a per-app override after a blocked launch: open System Settings > Privacy & Security, scroll down, click Open Anyway, and choose Open when the alert appears again. Apple describes it as a temporary override for an app you are certain came from a trustworthy source and has not been tampered with.［1］
Before using it, you should be able to answer yes to all of these:
- Did I reach the developer through an independently verified official channel?
- Is this the expected current file for my Mac and macOS version?
- Did I verify the file using information not supplied by an unknown intermediary?
- Do I understand why the app lacks normal verification?
- Do I understand the permissions and system changes it will request?
- Is important data backed up, and can I remove the app if behavior is unexpected?
The override should apply only to that reviewed app. Do not turn off security globally. On a managed Mac, ask the administrator because policy may intentionally prohibit the software.
What permissions should you watch after launch?
An app requesting Accessibility, Full Disk Access, Screen Recording, input monitoring, login-item persistence, system extensions, or administrator credentials can gain significant capability. A legitimate app may need one of these, but the request must match its purpose.
Deny unexpected access. Check the developer’s documentation and your organization’s policy before granting it. If the app immediately requests unrelated permissions, installs unknown helpers, changes the browser, or contacts suspicious domains, stop using it and seek security review.
What if macOS says the app is damaged or will harm the Mac?
Do not treat those messages as the same Gatekeeper uncertainty. Follow Apple’s current instructions, move the app to the Bin when advised, and obtain a clean official copy only if the publisher confirms one. Apple describes stronger alerts for detected malware, revoked authorization, or damaged and modified software.［1］
If you already ran a suspicious app, disconnect it from sensitive accounts, note what permissions you granted, preserve relevant alert details, update macOS, and follow your organization’s incident process. Changing passwords should be done from a known-clean device when credential theft is plausible.
Summary
“Apple cannot check it for malicious software” means normal Gatekeeper trust verification did not complete. Verify the publisher and file before deciding. Prefer an official current build, avoid global bypass commands, and use a per-app override only when you are certain the source is trustworthy and the file is unaltered.
FAQ
Does the warning prove the app is malware?
No. It means macOS could not complete its normal trust check. That uncertainty is a reason to investigate, not evidence of safety.
Is every app outside the App Store unsafe?
No. Apple supports distribution with Developer ID signing and notarization, but you should still verify the publisher and file.［1］
Should I use a Terminal command to remove the warning?
Not as a default solution. A bypass changes enforcement without proving the app’s origin or integrity.
Is “Open Anyway” the same as disabling Gatekeeper?
No. Apple provides a per-app approval path; use it only for a specific reviewed file from a trusted source.［1］
How is “developer cannot be verified” different?
Apple lists it as a separate alert: the developer can’t be verified and, in macOS Catalina and later, the app hasn’t been notarized, so macOS can’t verify that it is free of malware. Handle it the same way: look for an updated or alternative app, and override only a trusted, unaltered file.［1］
Does a checksum prove an app is safe?
It proves a file matches the referenced checksum. Trust also depends on where the checksum came from, the publisher, signing, behavior, and permissions.
What if the Mac is managed by work or school?
Do not override organizational controls. Ask the administrator to review and approve the app through the managed process.
What if I already opened a suspicious app?
Stop using it, review granted permissions and persistence, update security tools, and follow an incident process. Use a known-clean device for credential recovery if theft is possible.
Sources:
- Apple Support — Safely open apps on your Mac — https://support.apple.com/en-euro/102445
- Apple Platform Security — App security in macOS — https://support.apple.com/guide/security/app-security-overview-sec35dd877d0/web
- Apple Platform Deployment — Gatekeeper and runtime protection — https://support.apple.com/guide/deployment/gatekeeper-and-runtime-protection-dep323ab8aa3/web
Sources checked 4 October 2026.
Related Articles:
