In addition to what @Eau Rouge says you just need to practice safe computing habits. Try to visit only legitimate websites and hover over the link to view it on the status bar of the browser (or app) to make sure the domain in the link is going to a legitimate website before you click on any links. The same applies to any emails, text messages, etc. even if they are from trusted sources such as family, friends, or co-workers. It is best not to click on any links in emails, but sometimes it is necessary when setting up a new online account or resetting a password. If you receive any messages (emails, texts, etc.) which claim there is an issue with one of your accounts, then do not click on any links as it is most likely a phishing attempt. If you think the message is legitimate, then manually access the account by using a bookmark or manually entering the URL and logging in or by using an authorized app you normally use to access the account.
Plus minimize the apps you install on the computer and only acquire those apps from either the App Store or directly from the developer's website. Make sure the apps you install are reputable even if you get them from the Apple App Store (the App Store does not guarantee the apps are safe). Many browser extensions and add-ons are also risky.
Whenever macOS prompts you for your admin password, take a second to think about what you are doing. If you are not doing something that requires admin privileges, then may you should investigate further before proceeding.
Doing these things will greatly reduce your risk of getting malware or compromising your accounts.
Keep in mind that some anti-virus and security apps actually sell your personal information. One example is Avast which has been caught multiple times selling personal information. They were at one time a respected anti-virus provider. If you ever suspect you have malware, then you can run MalwareBytes to check and clean the Mac (this is the only app that really works on a Mac and can be run manually as needed instead of having it run all the time as a real time on access scanner). You really should never need it if you practice safe computing habits, but sometimes things will happen no matter how careful you are.
