Investigation & Remediation

List the login items and background helpers registered in macOS's modern Background Task Management database (System Settings ▸ General ▸ Login Items & Extensions) — each with its name, developer, type, and whether it's enabled. This sees the items that register themselves the modern way (SMAppService), which the legacy startup-plist scan can't.

Check your Chromium-family browsers (Chrome, Edge, Brave, Vivaldi, Opera) for a hijacked homepage, default search engine, or 'open these pages on startup' setting — the classic adware and browser-hijack tells that a browser-extension list and a hosts-file check don't cover.

List the websites allowed to push desktop notifications in your browsers. Scam sites trick people into granting notification permission and then spam fake 'your Mac is infected' pop-ups — this shows who can, so you can revoke the ones you don't recognise.

Report which app is set to open URL schemes (http/https/mailto) and file types, read from the LaunchServices database. Adware sometimes hijacks the web-link handler to a rogue 'browser' — this shows your real default browser and mail app.

Analyse a link for phishing red flags — offline, on-device, without visiting it. Checks for the '@' disguise trick, a raw-IP host, look-alike (punycode / unicode homograph) domains, a brand impersonated in a sub-domain, link-shorteners that hide the destination, plain http, and risky top-level domains — returning a risk score, the specific red flags, and a plain-English verdict.

Analyse a suspicious email's raw headers for spoofing — offline, on-device. Reads the SPF / DKIM / DMARC verdicts the receiving server stamped, and flags a From-vs-Return-Path domain mismatch or a Reply-To that points elsewhere — the tells of a forged sender.

Check live for available macOS software updates by contacting Apple's servers, returning the actual available updates and whether a restart is needed. It never installs anything.

Find photos on this Mac that carry embedded GPS location data — a whole-Mac Spotlight sweep that returns the count and a few sample paths without reading the photos. A geotagged photo has your location baked in, so this flags what to strip before sharing.

Diagnose why the internet isn't working with a staged check from the inside out: active network interface → router reachable → DNS resolving → internet reachable. Reports which step first fails, so you know exactly where the problem is.

Report whether the clipboard is currently holding something sensitive — a password, key, token, or card number — without ever showing or logging its contents. Whatever you copy stays on the clipboard until overwritten, and Universal Clipboard can sync it to your other Apple devices.

Rebuild the LaunchServices database and relaunch the Dock — the standard fix when the wrong app opens your files or links, or the 'Open With' menu shows duplicate entries.

Tighten your personal folders (Desktop, Documents, Downloads, Library and the credential folders) so other user accounts on this Mac can no longer read them. Your Public folder is left shareable by design.

Lock exposed credential files (AWS, SSH, Git, Docker, Kubernetes, npm and GnuPG credentials) to owner-only permissions so other accounts can't read them. Cyclone only changes permissions — it never reads the contents.

Restart the macOS audio system — the classic fix when there's no sound, audio is glitching, or an output/input device isn't recognised. macOS relaunches it automatically in a second.

Restart the macOS Bluetooth system — the classic fix when Bluetooth is stuck, devices won't pair or reconnect, or the Bluetooth menu is unresponsive. macOS relaunches it automatically in a second.

Erase one website's cookies and browsing-history entries across your browsers (Chromium-family and Firefox), surgically — it removes only the rows matching that site, so you stay logged in to every other one.