Introduction
This article explains how to set up Scam, phishing, and malware protection (formerly Threat Protection Pro™) on macOS Ventura, Sonoma, and Monterey.
Before you start
- Scam, phishing, and malware protection is only available with selected NordVPN plans.
- If you can't see the shield icon in the app, you may have the App Store version. You need to switch from the NordVPN macOS App Store app to the sideloaded version.
- You will need your computer's password to complete the setup.
- If you are using a newer macOS version, check out enabling Scam, phishing, and malware protection on macOS instead.
- In the redesigned app, the main Scam, phishing, and malware protection tab no longer shows per-feature toggles. All sub-feature toggles are now grouped under three super-feature blocks - Anti-malware, Advanced browsing protection, and Ad and tracker blocker - inside the Advanced settings screen, accessed from the Protection preferences card on the main page.
Here's what to do
For macOS Ventura and Sonoma
- Open the NordVPN app and click the shield icon in the left bar.
- In the hero section, click Turn on protection. This launches the setup wizard.
- Click Set up Scam, phishing, and malware protection.
- Click System settings > Privacy & security and allow the NordVPN application to load. Once done, return to the NordVPN app and click Continue.
- In the System Settings window, go to Privacy & Security and click Allow next to the message about system software from NordVPN being blocked.
- Enter your computer's password or use Touch ID and click Update settings.
- Return to the NordVPN app and click Continue.
- Click Add proxy configurations, then click Allow in the pop-up window.
- If prompted, restart your web browsers to enable full protection.
- Click Continue in the NordVPN app.
- Go to System settings > Privacy & security > Full disk access and click the toggle switch next to NordVPN Scam, phishing, and malware protection.
Once setup is complete, the status badge in the left app section will change to ACTIVE. If the badge shows Not active. Waiting for VPN, connect to a VPN server to activate protection. If it shows OFF, click Turn on protection.
If a Permissions alert banner appears on the main page or Protection history view, click Let's do it to re-open the setup wizard and grant the missing system extension permissions.
For macOS Monterey
- Open the NordVPN app and click the shield icon in the left bar.
- Click Turn on protection, then click Set up Scam, phishing, and malware protection.
- Click the button to go to System settings > Privacy & security. Once the settings load, return to the NordVPN app and click Next.
- Click Add proxy configurations, then click Allow in the pop-up window. Return to the NordVPN app and click Next.
- If prompted, restart your web browsers to enable full protection.
- Click Next in the NordVPN app.
- Go to System preferences > Security & privacy > Privacy and select Full Disk Access.
- Check the box for NordVPN Scam, phishing, and malware protection.
To enable the cloud-based scanner
In the redesigned app, the Cloud-based threat scanner sits inside the Malware scanner inner view, under the Anti-malware block of Advanced settings.
- Click the shield icon in the left bar of the NordVPN app.
- Click the Protection preferences card to open Advanced settings.
- Under the Anti-malware block, click the Malware scanner row to open its inner view.
- Make sure the malware scanner is toggled on, then click the toggle next to Cloud-based threat scanner to enable it.
By default, both Cloud-based threat scanner (to respect privacy) and Auto-delete malicious files (to prevent accidental permanent file loss) are turned off. Both toggles are disabled while the malware scanner is off.
Good to know about the redesigned experience
- Pause and resume: Click Pause protection in the hero section to temporarily disable all superfeatures for 5 min, 15 min, 30 min, 1 hour, or 24 hours. A pause toast with a countdown timer is shown across all screens of the tab. Click Resume protection at any time, or wait for the timer to elapse. Pause state is not preserved between app restarts.
- Action required banner: If there are files in quarantine or vulnerable apps detected, a Security issues found banner appears below the hero section with a Review and resolve CTA that takes you to Protection history > All threats.
- Superfeature "Turned off" banners: In Protection history, if all sub-features of a superfeature are disabled, a banner appears in the corresponding tab (Malicious files, Malicious websites, or Ads and trackers) with a Turn on CTA.
- Quarantine auto-cleanup: Quarantined files are automatically deleted after 30 days. Hover the info icon next to the Quarantined files heading for details.
- History limit: Protection history stores up to 100 entries per category (Malicious files, Malicious websites, Ads, and trackers), excluding quarantined files. When the cap is reached, the oldest entry is removed (FIFO), and the newest is added at the top.
-
Threat statuses you'll see:
BLOCKED,UNBLOCKED,DETECTED,ALERTS OFF,ALLOWED,DELETED,QUARANTINED,COULDN'T DELETE, plus vulnerability levelsLOW LEVEL VULNERABILITY,MEDIUM LEVEL VULNERABILITY, andCRITICAL LEVEL VULNERABILITY.
Additional tips
- If prompted, make sure to restart your browsers to enable ad and tracker blocking.
- If setup fails, a Couldn't start toast appears with Get help and Try again buttons again. If your Mac is managed by an organization and the system extension is blocked, a Managed device toast appears instead — contact your IT administrator to allow the NordVPN system extension.
- In case you're experiencing any issues with NordVPN Scam, phishing, and malware protection on macOS, visit our guide on troubleshooting them.
