Finder lost access to protected data on MacBook Pro

I wanted to share my recent experience with this exact issue in case it helps others.

It turns out my Mac was indeed infected with malware (specifically a strain known as PamStealer or so informs me Siri AI). The biggest red flag was that there was a fake "Finder" application running from my user paths rather than the actual system paths.

Here is what I discovered and the steps I took to remove it:

• The Location: The malicious file was located in ~/Library/Caches/com.apple.finder/Finder.app. (The real Finder is always in /System/Library/CoreServices/).

• The Process: I used Activity Monitor to force quit the fake Finder process running from that user directory.

• The Cleanup: I deleted the com.apple.finder folder from my Caches, and then went into System Settings > General > Login Items to remove the fake Finder from both "Open at Login" and "Background App Activity."

Disclaimer: I identified and resolved this issue with the help of Siri AI. While the information provided was helpful for my situation, AI can hallucinate, so please proceed with caution and verify these steps for your own system.

I still am not sure how this made its way onto my computer, but I suspect it might have something to do with my recent Github downloads spree—this is the first virus I've had since Mac OS X 10.0!

Hopefully, this helps someone else avoid granting it Full Disk Access.

hmmm. not seen this previous to the OP Posted on Sep 15,

I do not have Finder in my Full Disk Access..

I might suspect if you have folders/files protected with a password this could be the issue/cause(?)

I would have no reservation about allowing Full Disk Access for your Finder option there in your screen shot and compare your results...

I see no down side.

You do not need to be running the 3rd party app Malwarebytes in the back ground, only launch/run it if you have an issue.

Uninstall all third party apps that are Cleaners/Optimizers/VPN/Anti-Virus

all known to cause issues on the macOS

I would verify the default macOS Xprotect.app is turned on in your Full Disk Access :

"I wanted to share my recent experience with this exact issue in case it helps others.: It turns out my Mac was indeed infected with malware"

-------

IMPORTANT:

Report this to Apple:

A. Provide Screenshots via Email:

Send screenshots you have of this file and the application, and name them accordingly. Add them as an attachment, and send it off to: reportaproblem@apple.com

and...



B. Use Apple's Feedback Site:

Do Your Part: Inform Apple of this. They will not get back to directly, but the more feedback they receive on this, the more they will know what is going on, and what their customers need are. The more feedback that Apple's developers receive on this, the more they will know what issues exist and what fixes to include in updates to come.

1. Go Here: Feedback - MacBook Pro - Apple
2. Select: "Bug Report" for the "Feedback Type"
3. Comment: that is it malware that you found. Include the URL f this thread.
4. Proceed from there as necessary.

robgipe wrote:

I just got a pop-up window on my MacBook Pro that says "Finder lost access to protected data."

I was prompted to enable Finder in settings. What is going on?

? Protected data where (?) Internal external, a specific app— what are you doing when you get

"prompted to enable Finder in settings" this makes no sense, maybe you can rephrase the question

or give more details and paint a bigger picture of your issue.

Shutting down and restarting the computer tends to solve many issues— I would start there.

robgipe wrote:

Official Apple Support Community

Where in Finder does it take you when you click "Open Settings"

old issue, new issue, what changed— you have yet to paint a bigger picture...

you can Call Customer Support (800) MY–APPLE (800–692–7753)

or on line https://getsupport.apple.com/

or call AppleCare Support at 1-800-APLCARE (800-275-2273)

Outside the USA—Contact Apple for support and service by phone

See a list of Apple phone numbers around the world.

Contact Apple Support - Apple Support

Some info: https://www.jamf.com/blog/pamstealer-macos-infostealer-applescript-rust/

Hey! I'm having the same issue. It's been happening for weeks now and it's really annoying. If you click 'Not now,' the pop-up just keeps reappearing every 15 to 30 minutes. If you click 'Open Settings,' it takes you to the settings page so you can grant full access to Finder. To make matters worse, my Mac's language is set to Spanish, so it makes zero sense for this pop-up to be showing up in English. I'm worried that if I grant it access, I might end up getting hacked or something like that. I don't know if anyone who had this issue knows how to fix it, or if it's normal for this to pop up. What should I do?