It’s rare that we get to see a brand-new Mac antivirus, but MacPaw’s Moonlock is exactly that. It builds on the same antimalware technology as the company’s CleanMyMac, which also features tools to clean and tune up your Mac. Its user interface is elegant, and it includes useful bonuses such as a basic VPN and a scan that helps you improve your Mac’s security configuration. A feature that blocks all traffic from any of 250 countries proved awkward in testing, though, and it doesn't do anything to detect malicious or fraudulent websites. It also didn't excel in independent lab tests. It’s a new product, and may well grow into its feature set. Until then, consider our Editors’ Choice antivirus apps for your Mac: Bitdefender Antivirus Plus and Norton AntiVirus Plus, both of which hold excellent scores from two antivirus labs.

How Much Does Moonlock Cost?

Most of the Mac antivirus apps I track fall within the price range of just under $40 per year to just under $50 for a one-Mac license. For example, CleanMyMac, G Data Antivirus, and Trend Micro Antivirus all cost $39.95 per year, while Bitdefender, F-Secure Internet Security, Intego Mac Internet Security, and Webroot Essentials cost $49.99. Moonlock is just a little higher, $54 per year. That’s still less than Norton AntiVirus, which starts at $59.99 for one license.

Of course, a true Mac enthusiast doesn’t stop with protecting just one Mac. A Moonlock subscription for two devices costs $84, more than any competitor that offers a two-pack. Malwarebytes Premium Security, by contrast, ranges from $44.95 for one device to $49.95 for two, while ESET Cyber Security costs $39.99 for single licenses and $44.99 for pairs.

The best Moonlock deal is the five-pack for $168, which pencils out to $33.60 per Mac. That’s still more expensive than any five-pack I’ve seen except for Avast One Gold for Mac, which runs $179.99 per year. McAfee Total Protection for Mac and Norton 360 Deluxe for Mac are comparable, priced at $119.99 per year for a five-device license. But Avast, McAfee, and Norton are all full security suites. Moonlock’s pricing isn’t outrageous, but it’s higher than most.

Which Versions of macOS Are Compatible With Moonlock?

As this is a brand-new product, it’s not surprising that a new-ish macOS version is required. You can run Moonlock on macOS 13 (Ventura) or later. Webroot supports the current macOS and the three previous versions, meaning it is also compatible with Ventura and later. With Norton, support only extends back to the two previous versions, so it works with macOS 14 (Sonoma) or later.

Most Mac users keep up with macOS updates, but sometimes old hardware or legacy software can prevent you from upgrading to the latest version. ClamXAV and K7 support versions back to 10.10 (Yosemite), as do macOS editions of Bitdefender and Panda.

Getting Started With Moonlock

Once you create your Moonlock account and download the app, installation is quick and simple. As with any Mac antivirus, you must grant permissions, such as Full Disk Access, to allow Moonlock to perform its job.

Many antivirus and other security apps display a simple slideshow touting the app’s features during the install process. Moonlock does something similar, but its slides are more like pages from a graphic novel, as you can see above. From the outset, Moonlock presents itself as something other than a typical antivirus.

(Credit: MacPaw/PCMag)

Once installation is complete, Moonlock recommends a full scan. The full scan finished in about nine minutes, which is much quicker than the current average of 50 minutes. The quick scan was completed in under a minute.

(Credit: MacPaw/PCMag)

Initially, the main window reports that your Mac is at risk and offers to resolve the issue. Clicking a button titled Explore brings up the Home page, which features a collection of recommendations to enhance your Mac’s security. These include such things as perusing security tips, making Settings changes to improve security, and enabling the integrated VPN.

(Credit: MacPaw/PCMag)

Down the left side of the main window, you’ll find a simple menu with icons representing: Home, Malware Scanner, VPN, Network Inspector, System Protection, and Security Advisor. Clicking any of these brings up a page devoted to the topic, with each page tinted in a different soft color. I’ll go over these in detail below.

What Do the Independent Labs Say About Moonlock?

Most of my programming skills and experience in analyzing antivirus apps are Windows-based. I have a nice collection of utility programs for my hands-on testing, and I have the resources to gather a new set of Windows malware from the internet on a regular basis. My testing and analysis tools don’t work on the Mac, though, so third-party testing lab reports are important. I follow five such labs in my Windows reviews, and two of those also evaluate antivirus apps specifically designed for macOS.

Many years ago, when I first expanded my antivirus coverage to include Mac-specific apps, I only selected apps that appeared in reports from at least one lab. However, the labs change their lineups for testing regularly, and at present, almost 60% of the Mac antivirus apps I follow don’t have current results from either of those two labs. The good news is that Moonlock appears in the latest report from AV-Test Institute. The bad news is that it didn’t earn the best scores from that lab.

The experts at AV-Test rate antivirus apps on three criteria: protection, performance, and usability. The last one, usability, refers to minimizing false positives, which are valid apps or sites that are erroneously flagged as dangerous. An app can earn six points in each category, for a maximum score of 18. Moonlock scored 5.5 out of 6 in the essential protection category and achieved a perfect 6 in usability. However, its performance was rated just 4.5 points, for an overall total of 16. Almost all the other tested products achieved a perfect 18 points, including Avast One Basic, ESET, and Norton.

With AV-Comparatives, products receive a percentage-based score for their malware protection capabilities. Avast, AVG AntiVirus, and Norton all reached 100%; Moonlock wasn’t considered, which makes sense considering it's new. Avast, AVG, and Norton received the maximum possible score from both AV-Comparatives and AV-Test, making them the big winners in the lab test challenge.

Security Advisor Gives Good Advice

When you open the Security Advisor tab, you quickly see that it’s not merely some dry pieces of advice. Yes, you see headings like Use Strong Unique Passwords and Think Before You Click. Each page of advice includes a picture along with detailed suggestions. At the bottom of the page, Moonlock asks you to “shake on it” and commit to acting on this piece of advice.

(Credit: MacPaw/PCMag)

Each time you click the Deal button to signal your agreement, Moonlock updates the number of tips you’ve committed to follow. When you’ve made a clean sweep, committing to all the advice, the Security Advisor menu icon gets a checkmark overlay, and the Security Advisor panel in the list of recommendations vanishes.

System Protection Corrects Your Security Settings

The next recommendation advises you to use System Protection to tighten your Mac’s security. Its speedy scan found nine settings to tweak on my test Mac.

(Credit: MacPaw/PCMag)

On digging in for details, I found that besides the nine suggested changes, Moonlock listed 15 settings that were already correct. Yay me! For each of the outstanding nine, it provided detailed instructions on how to open the Mac’s configuration settings and make the necessary changes. After you’ve finished following each set of instructions, Moonlock offers to check again and confirm your improvements.

I didn’t actually want to enable FileVault on my test Mac, as it could interfere with testing other products. And I didn’t want to remove the secondary user account that I need for some tests. Since I didn’t clear all the recommended items, the panel for System Protection in the Home page’s Recommendations list didn’t vanish. Apparently, I improved my settings enough that the overall security status changed from Exposed to Protected.

Very Simple VPN

The next panel in the list of recommendations advised me to turn on the VPN. MacPaw publishes a standalone VPN called ClearVPN, with a stripped-down version integrated into Moonlock. You pay $9.99 per month for the standalone ClearVPN, the same as Proton, TorGuard, and TunnelBear. That’s just slightly below the average for VPN services we cover. If you pay annually, the price drops to $3.75 per month or $44.99 per year, which is more than $10 below the current average.

A VPN service is a valuable addition to any antivirus software. The antivirus protects local data against malware, while the VPN protects your data as it travels the internet. Traffic between your Mac and the VPN server is thoroughly encrypted, meaning nobody, not even the proprietor of the shady internet café whose Wi-Fi you’re using, can interfere with it.

(Credit: MacPaw/PCMag)

Every website you visit necessarily receives your IP address—without that, it wouldn’t know where to send any responses. That also means that every website can use IP geolocation to roughly determine your physical location. That’s not true when you’re using a VPN, though, as websites just see the VPN server’s IP address. Additionally, selecting a VPN server location wisely can allow you to access content that would otherwise be inaccessible to users in your region.

To start using VPN protection, simply click the Start button on the VPN page. Once Moonlock makes the connection, your traffic is protected by encryption, and your geographic location is disguised as the server’s location.

(Credit: MacPaw/PCMag)

You do have the option to choose from 61 server cities in 50 countries. To help you choose, the server list includes a visual representation of the latency for each server. Latency refers to the time elapsed between when the server receives a request and returns a response. High latency can mean a slow connection. In our full VPN reviews, we test each service’s effect on latency, upload speed, and download speed. ClearVPN hasn’t received this treatment as yet.

Moonlock’s server collection is on the small side and strongly Eurocentric. Almost 55% of the available server locations are in Europe, with about another 20% in North America. You get just one server choice in Africa, and just four in South America. If you’re a serious VPN user looking for a better geographical spread, ExpressVPN might be a better choice. It has more than 3,000 servers across 105 countries, and the server collection has better geographical diversity than most.

Most VPNs use one of a handful of time-tested protocols to encrypt your web traffic. At PCMag, we like WireGuard and OpenVPN, both of which are modern, open-source projects. Some VPNs offer a proprietary protocol, or one specifically designed to bypass VPN-averse sites like Netflix. And most let you choose from a selection of protocols. Not Moonlock. It’s unclear exactly what protocol it uses, and there’s no option for the user to choose.

You can (and should) enable the VPN’s kill switch feature in Moonlock Settings. Now, if your connection to the VPN server drops for some reason, Moonlock blocks all internet access until that connection is restored. This prevents any possibility of data being sent in the clear, without VPN protection.

That’s it for settings. You can choose a server location and flip the kill switch on or off. As noted, there’s no choice of VPN protocols. You can’t configure split tunneling to run specific connections outside the VPN. And this simplicity may be just fine for many users. If you do nothing more than click the Start button, you’ve added serious protection for your internet activity.

Network Inspector Isn’t What You Think

Several antivirus apps and security suites include a feature called Network Inspector. Most of them work like what you get in Avast One Gold. The app runs a scan that lists all the devices on your network, providing details such as name, IP address, and MAC address. It also flags checks the security status for all connected devices. And if a new, unknown device connects to the network, the app notifies you of the intrusion.

Moonlock’s Network Inspector couldn’t be more different. According to the app, it “reduces your digital footprint” by blocking all internet traffic from countries you’ve put on the block list. The list is extensive, encompassing over 250 countries worldwide. Unlike the VPN’s list, this one covers all the major continents, with the biggest number coming from Africa.

(Credit: MacPaw/PCMag)

You can only see five countries at a time, and there’s no guidance as to which ones you should block. Are connections from Djibouti more dangerous than those from Kiribati? Is San Marino a hotbed of hacking? Could you find Niue or Mayotte on a map?

For a simple sanity check, I set Moonlock to block connections from the United States. It visibly blocked the oh-so-American websites cia.gov and nsa.gov, just showing a browser error message. I would have been happier with a message from Moonlock explaining what happened. Interestingly, whitehouse.gov and fbi.gov came through just fine. Perhaps these sites are no longer hosted in the US.

In my opinion, this feature needs improvement. The average user has no idea which of the 250+ countries might pose a threat. And when the filter kicks in, there’s no explanation.

Scans and Scheduling

I mentioned earlier that Moonlock’s full scan finished in just nine minutes. However, the time needed for a scan is irrelevant if you don’t run that scan. Another panel in the Recommendations list advises using the Scan Planner.

(Credit: MacPaw/PCMag)

Scheduling a scan is simple. You start by naming your scan and choosing the type: Deep, Balanced, or Quick. Then, you select the scan frequency, choosing from Daily, Weekly, Monthly, or Once. For all frequencies except Daily, you choose the day of the week. Save the scan, and you’ve got a plan.

You can schedule multiple scans. For example, you might include a daily quick scan, a weekly balanced scan, and a monthly deep scan. As with other recommendations, once you dig into the feature, the advice panel disappears.

There’s one more type of scan I haven’t mentioned. Almost all Mac antivirus apps advertise the ability to detect and eliminate Windows malware, even though a malicious Windows program can’t run on a Mac. The reasoning is that wiping these items from your Mac ensures they can’t possibly make their way across the network to a PC that’s vulnerable to their shenanigans. Moonlock does not guarantee the removal of Windows malware. Indeed, when I copied about 90 Windows malware samples to a thumb drive and scanned it, Moonlock detected nothing at all.

Relax With Some Cartoons

If you’ve followed along and activated the features described so far, you won’t have many recommendations left on the home page. On my test system, I had eight informational items covering a broad range of topics, among them phishing, malvertising, and typosquatting.

(Credit: MacPaw/PCMag)

Each panel features a button labeled Learn More or Watch Now. For those with a Learn More button, clicking it opens an informational document online. If the button says Watch Now, clicking it brings up a Securitoon—a short cartoon video that illustrates the concept in question.

These panels don’t automatically vanish when you’ve viewed their related content. But each has a Close button to remove it from the list of recommendations.

Phishing Protection Not Present

At this point in my testing, my list of recommendations was blank except for the System Protection box. I couldn’t get it to recognize that I had deleted all secondary user accounts, and I really didn’t want to enable FileVault on this test Mac. Still, I felt quite accomplished getting through the rest of the tasks.

I did figure I had one more feature to test, though not a visible one. In my research, I found a detailed description of MacPaw's local-only phishing detection system. I prepared to put this system to the test.

To test phishing protection, I start by scraping hundreds of URLs that have been recently reported as fraudulent. Some are verified phish, while others haven’t been evaluated yet. I launch each in four browsers, one protected by the antivirus under examination and the other three using the phishing protection built into Chrome, Edge, and Firefox. If any of the four browsers fails to load a page, I toss that one. I also toss any that don’t clearly fit the definition of a phishing fraud.

Phishing protection in the three browsers uses a combination of blocklisting known frauds and analyzing unknowns to detect new fakes. If a known phishing page is temporarily down, the browsers can still block it. MacPaw's system, based on my reading, works by analyzing the appearance and content of the page. I encountered a large number of pages that were blocked by all three browsers, but failed to load on the Moonlock-protected Mac.

I laboriously ran hundreds of suspected phishing URLs through this testing process, then dumped the resulting data into my analysis spreadsheet. The result? Moonlock didn’t block a single page. This includes dozens of unmistakable fakes that were caught by all three browsers. For example, the screenshot below shows a page that's pretending to be Netflix, but has a URL with the domain gregarious-genie-2295e4.netlify.app.

(Credit: MacPaw/PCMag)

Figuring I had perhaps failed to enable this feature correctly, I checked with my MacPaw contacts. From them, I learned that the description I found online was a report on technology under development, not a feature of Moonlock. Moonlock does not actually attempt to detect fraudulent or malicious websites.

Don’t imagine that detecting phishing fraud on the Mac is too difficult. Five competing products reached 100% detection in their own phishing tests: AVG, Avira Free Antivirus, McAfee, Norton, and Webroot.