• Work from an standard (non-admin) user account.
• Review the settings in System Preferences » Security & Privacy and pick a reasonable ground between convenience and security.
• At the very least, "Require an administrator password to access system-wide preferences" (found under the "Advanced..." button.)
• Be wary of any third-party app that asks for an administrator password, and try to see if it runs after denying the prompt. Dropbox, for example, seems to work fine even if I cancel its second (after installation) admin prompt. (There were news about it faking the prompt and storing your macOS password [2] for automatic updates...)
• You may want to tighten the firewall settings, and/or consider Little Snitch [3].
• If you have to install something from a .pkg file, which can autorun scripts, try to review the .pkg and its scripts with Pacifist [0] first. It may be possible to just extract the payload with Pacifist and run the app just fine without "installing" the .pkg.
• Make regular backups. Automatic (e.g. Time Machine) AND manual (of your most important stuff at least.)
• Don’t use the same passwords for different things.
• Enable multi-factor authentication on as many services as you can.
• Visit dodgy websites in private browsing mode, or a secondary, locked-down browser like Tor [1].
• If you can't help downloading pirated/"cracked" apps or games, try to run them from a different user account.
• If concerned about outright theft of your Mac, enable FileVault full disk encryption, and set a firmware password. [4]
• Whenever you're bored or something is acting janky, check the usual places where third-party processes can install themselves and hook into your system:
- System Preferences » Security & Privacy » Privacy » Accessibility
- System Preferences » Users & Groups » Login Items
- /System/Library/LaunchAgents, /System/Library/LaunchDaemons, /System/Library/StartupItems
- /Library/LaunchAgents, /Library/LaunchDaemons, /Library/StartupItems, /Library/Internet Plug-Ins
- Check for 3rd-party kernel extensions:
kextstat -kl | awk ' !/apple/ { print $6 $7 } '
----
I've used Macs without an antivirus since 2012 and I haven't been hit by malware yet... I think. :)
[0] http://www.charlessoft.com
[1] https://www.torproject.org/projects/torbrowser.html.en
[2] https://news.ycombinator.com/item?id=12463338 (How Dropbox Hacks Your Mac)