Can macOS Tahoe detect malware in a downloaded zip file containing JPEG images?

Your Mac is not compromised. Simply downloading a ZIP file cannot infect your system.

Here is how macOS behaves and what you need to know to ease your mind:

1. When Does macOS Scan the File?

Apple's built-in security systems (XProtect and Gatekeeper) act at specific moments:

• Upon Download: macOS applies a "quarantine tag" to the ZIP file, but it usually doesn't deeply scan the closed archive the second it hits your drive.
• Upon Opening: The actual security check triggers the exact moment you double-click to extract the ZIP. macOS intercepts the action and scans the contents for known malware before letting you open it.

2. Are JPEG Files Dangerous?

Real images (like .jpg or .jpeg files) are static data, not executable programs: they cannot infect your Mac on their own.

The only real risk is the double extension trick. Sometimes, bad actors rename a virus to photo.jpg.app to make it look like an image. If Finder is set to hide extensions, you might only see photo.jpg, but the icon will look like an application rather than a photo thumbnail.

What to Do Next (Safely)

1. Double-click the ZIP: Extracting the file is safe because you are not executing any code.
2. Check the "Kind" in Finder: Verify that the Kind column (or by right-clicking and selecting Get Info) clearly says JPEG Image (or PNG)—and not "Application," "Script," or "Disk Image (.dmg)."
3. Trash it if in doubt: If you notice anything strange, or if opening the file prompts you to enter your Mac's administrator password, don't do it. Drag everything to the Trash and empty it.

The key feature is that MacOS does not allow just 'any old junk' from anywhere to become Executable.

The second feature that makes the first one bulletproof is that malware can not attach itself to parts of the System.

MacOS shares a lot of the lock-down mechanisms developed for the iPhone. Applications are all sand-boxed with a list of the resources they require, and they cannot access anything outside their sandbox without crashing. Signed Applications are checked that they are from legitimate Developers, and Notarized Applications are delivered with the assurance that they have NOT been modified since their release by the Developer.

Introduced just before MacOS 12 Monterey, the system is now on a Separate, cryptographically—signed ‘sealed System Volume’. The Mac runs off read-only snapshots of this volume, which is not writeable using ordinary means. Any unauthorized changes to the crypto-signed volume are very quickly detected and you are alerted.

So you could store just about every malware known to mankind on your Mac, and your Mac would not get infected spontaneously. Scanning for virus-like patterns might make you feel a little better now, but non-stop scanning is outdated nonsense, and a tremendous waste of resources.

Nothing can become Executable Unless/Until you supply your Admin password to "make it so".

--------

Some users may prefer to create a new Admin User with a unique password (be sure to write that password down somewhere). Then log in as the new Admin and demote their daily-use account to an "ordinary" non-Admin account. In that case, nothing can be installed "by accident" because you will need to provide both the Admin Username AND Password to install anything. This gives you an additional step to pause and think about whether you really want to do this.

Others have provided great technical information about how macOS already protects you.

There is also a great resource that can give you piece of mind in cases like this. VirusTotal (https://www.virustotal.com/gui/home/upload) will allow you to upload a suspect file that it then analyzes using dozens of mainstream antivirus engines as well as other signatures. This weight of evidence provided can give you a good idea if you are dealing with something detectably malicious.

Is a zip archive of jpg images going to be a problem for you, or for most people? Unlikely. Very unlikely.

Most of the known security-related problems with unzip are crashers and not exploits, or can involve the consumption of excessive storage; so-called zip bombs.

There is a 2018-era problem with a zip-related library written in Go as well, an add-on library which some add-on apps might use.

There was a bug in iOS (CVE‑2025‑43300) as well, which was combined with a bug in WhatsApp (CVE-2025-55177) that could be used to exploit an iPhone, iPad, or Mac. These have been fixed in current versions.

None of this is likely arriving from an Etsy seller.

If you’re concerned about this sort of stuff, how robust are your macOS backups? And is two-factor authentication enabled? This because — in the unlikely event you are exploited — backups are usually part of your recovery.

Current versions of add-on tools, too?

With good backups and recent versions of tools, I wouldn’t be concerned. But I also don’t know your particular risks and exposures.

Kelly78745 wrote:

I thoughtlessly purchased several jpeg images from an Etsy seller. I downloaded the file but in the middle of the download realized that I could have just paid someone to hack me! Ugh. I’ve not opened the zip file and am wondering if OS Tahoe will recognize and alert if malware is detected before fully opening? Anyone know or have insight about jpegs and malware and Apple’s ability to identify before harm is done.

[Re-Titled by Moderator]

Original Title: Malware and jpegs

a good Apple Support reference:

Protecting against malware in macOS - Apple Support