imklaunchagent on Mac: what it is, is it a virus, and how to check it

What imklaunchagent does

imklaunchagent is a program that ships with macOS. It starts the input methods you pick for typing in other languages, so it appears in Activity Monitor on an ordinary Mac. It is not a virus, and the old claim that it is "part of targeted Mac malware attacks" is wrong.

1. 1

   You pick an input method

   An input method is what lets you type Chinese, Japanese, Korean, Vietnamese and other languages, or use a different keyboard layout or emoji and dictation helpers built on Apple's InputMethodKit. You add one in System Settings > Keyboard > Text Input > Input Sources.

2. 2

   launchd keeps the agent ready

   At login, launchd reads /System/Library/LaunchAgents/com.apple.imklaunchagent.plist and starts imklaunchagent. The plist sets KeepAlive, so launchd starts it again if it ever stops, and it registers four Mach service names that begin com.apple.inputmethodkit.

3. 3

   It launches and watches the input method

   Apple's manual page says it "is automatically invoked to launch input methods that are selected via direct user interaction", and that it monitors abnormal behavior: it will not launch an input method that keeps terminating unexpectedly within a short time.

File

/System/Library/Frameworks/InputMethodKit.framework/Versions/A/Resources/imklaunchagent, about 255 KB, a universal binary for Intel and Apple silicon

Owner

root, group wheel, in /System, which macOS keeps read-only

Signed by

Apple (Software Signing, Apple Code Signing Certification Authority, Apple Root CA)

Started by

launchd (process 1) from /System/Library/LaunchAgents/com.apple.imklaunchagent.plist, never by an app you installed

Documented as

"not intended to be invoked via other means and must not be terminated" (man imklaunchagent)

Can you remove it

No, and you should not try. It belongs to the operating system. You only need to remove a copy of the name found outside /System

Many users find it only because it sits in the process list all the time. A related thread on Ask Different, from someone who found it in Activity Monitor on Mojave and asked how to delete it, ended with the asker writing that the process is not harmful. The answer explained that macOS does not let anyone alter the contents of /System, so the "Operation not permitted" message they got is the system working as intended.

What we saw on a real Mac

We checked the file on a Mac running macOS 26.4.1 on 6 October 2026. This shows what the genuine file looks like. It does not show that yours is the genuine one.

Real or fake: where the "virus" idea came from

The genuine imklaunchagent is not malware. Two true things got mixed up on the old version of this page: the name sits in a folder that malware also uses, and a malicious file can borrow the name of a system process.

The danger is the name, not the file. MITRE's ATT&CK entry for Launch Agent persistence says the name of a malicious launch agent "may be disguised by using a name from the related operating system or benign software", and its list of examples includes Mac malware that used com.apple. names for its plist files. So a file called imklaunchagent in the wrong place deserves a look, and the one in /System does not.

LaunchAgents: the real malware technique behind the old claim

The old page described a "LaunchAgent virus" and treated the name imklaunchagent as that method. The two are different things: LaunchAgents are a normal macOS feature, malware does abuse them, and imklaunchagent is just one Apple program that happens to be started that way.

1. 2017-2018

   The picture the old page used

   It shows an Activity Monitor panel for Google Chrome (parent process launchd, 0.83% CPU) and a Finder window on a user's ~/Library/LaunchAgents folder with a few plist files. Neither window is imklaunchagent: they illustrate what a process panel and a LaunchAgents folder look like. The folder dates in the picture are 2017 and 2018.

   

2. 2016-2019

   Mac malware that persisted through LaunchAgents

   MITRE's list of examples includes Komplex (2016), whose plist was ~/Library/LaunchAgents/com.apple.updates.plist, Dok (2017), whose plists followed the pattern com.random.name.plist, and CoinTicker (2018), with .espl.plist and com.apple.[random string].plist. Each copied an Apple-looking name or a random one.

3. Today

   The technique is still used

   The same MITRE page lists entries added much later, for instance GlassWorm, which wrote a plist under /Library/LaunchAgents. A LaunchAgent plist is still one of the first places to look on an infected Mac.

One thing the old page got wrong: the agent folders are not mainly used for backups, and a plist is not suspicious because it starts a program. Apple's documentation says agents are the preferred way to run per-user background processes, and the same mechanism that starts a legitimate updater starts malware. What matters is whose program the plist points to.

Signs of a real infection, and what they do not prove

None of the signs below is caused by the genuine imklaunchagent. They are the signs of Mac malware or adware in general, and they are worth acting on whether or not you ever saw the name.

• Medium

  Apps in the menu bar that are not in your login items

  A program that starts at login without showing up in System Settings > General > Login Items & Extensions can be started by a LaunchAgent or LaunchDaemon plist instead. Compare the menu bar with that list.

• Medium

  Browser redirects and changed settings

  Redirects to ad-supported sites, a changed start page or search engine, and extensions you did not add point to adware or a browser hijacker, a nuisance rather than a trojan, but the same plist trick can keep it coming back.

• Medium

  Unknown processes using resources in the background

  A process you do not recognise with steady CPU or network use. Malware that mines cryptocurrency is one of the uses of background persistence, and MITRE lists CookieMiner as an example that installed several launch agents for mining software.

• High

  Remote access, keyloggers and data theft

  Several of the MITRE examples (CrossRAT, Keydnap, Proton, MacSpy) are remote access or credential-stealing programs that persist through a launch agent. We found no report that ties any of them to a file named imklaunchagent, so the old page's statement that this name "can use keyloggers" is not confirmed.

• High

  Ransomware

  The old page warned that such an infection may lead to ransomware that locks your files. Mac ransomware exists (ThiefQuest is in the same MITRE list and persisted through ~/Library/LaunchAgents), but we found nothing linking it to this name. Keep a backup you can restore from.

No one can say how long a hidden program runs before it shows a symptom. The old page said the same: there is no rule for it, so act on what you can check (path, signature, launch item) and not on how the Mac feels.

Do this when a page or a security tool called imklaunchagent suspicious, or when you find the name somewhere other than /System. The checks below are the ones we ran on our own Mac, so the output you should see is the one in the section above.

1. 1

   Find it in Activity Monitor

   Open Activity Monitor (Spotlight: Cmd + Space, type its name). In the View menu choose All Processes, then type imklaunchagent in the search box. Note the PID.

2. 2

   See the real path and parent

   Open Terminal and run ps -p <PID> -o pid,ppid,pcpu,rss,comm. The command column must read /System/Library/Frameworks/InputMethodKit.framework/Resources/imklaunchagent and ppid must be 1, which is launchd.

3. 3

   Verify the signature

   Run codesign -dvv /System/Library/Frameworks/InputMethodKit.framework/Versions/A/Resources/imklaunchagent and read the Authority lines: Software Signing, Apple Code Signing Certification Authority, Apple Root CA. Then run codesign --verify --verbose on the same path; it must say "valid on disk". If the path in the previous step was different, run both commands on that path: a copy that is not signed by Apple is not the system file.

4. 4

   See what starts it

   Run launchctl print gui/$(id -u)/com.apple.imklaunchagent. The path line must be /System/Library/LaunchAgents/com.apple.imklaunchagent.plist. If the path is a plist in ~/Library or /Library, a program you installed is behind the name.

5. 5

   Look in the user folders

   In Finder choose Go > Go to Folder and open ~/Library/LaunchAgents, /Library/LaunchAgents and /Library/LaunchDaemons. Apple's own imklaunchagent plist is not in any of them. A file there whose name contains imk or imklaunch is not the system one.

If every check passes, the file is Apple's and there is nothing to remove. If the path, the signature or the launch item does not match, go to the removal section further down.

imklaunchagent is already on every Mac. Real Mac malware arrives in the ways below, and may then start itself through a launch item. The old page said many Mac users believe their computers are immune: that belief is false.

• High

  Pirated and cracked software

  Cracked apps, pirated films, music and games, and "game cheat" packages are the oldest way in, because a small script can be added to the package unnoticed. This is the route the old page named.

• High

  Spam attachments and links

  An email can carry the file, or a link that opens a page that starts a download. Open attachments only when you expected them, from a sender you can confirm.

• Medium

  Hacked or malicious websites

  A legitimate site that has been hacked, or a page that says a browser, a player or a codec needs an update. Update software from its own menu or the App Store.

• Medium

  Installers that ask you to paste commands

  A .dmg or a web page that asks you to drag a file into Terminal or paste a line there hands the attacker the same rights you have.

The old advice stands: use official sources for programs, stay away from torrent sites and file-sharing services, and read email carefully, especially messages with attachments or links.

If it is a fake: removal steps

This applies only when a check above failed: a file named like imklaunchagent outside /System, a plist you did not install, or an unsigned binary. Never delete anything in /System, /usr/libexec or /Library/Apple: those are Apple's.

1. 1

   Note it, then stop it

   In Activity Monitor, select the process and click i, then Open Files and Ports to see what it has open. Write down the path, then click the stop button and choose Force Quit. A malicious item that is set to keep running will start again, which is why the next steps matter: the old page was right that removal does not last if the launch item stays.

2. 2

   Find the launch item that starts it

   Open ~/Library/LaunchAgents, /Library/LaunchAgents and /Library/LaunchDaemons with Go > Go to Folder. Open each recent plist with a text editor, or run plutil -p <file> in Terminal, and read Label and ProgramArguments: the second names the program that is started. A plist that points to the fake path or to a program you did not install is the one that restarts it.

3. 3

   Unload it, then delete both files

   The launchctl manual page describes bootout for stopping a loaded job: run launchctl bootout gui/$(id -u)/<Label> for a user agent, using the label you read. We did not run it on a fake item. Then move the plist and the program it pointed to to the Bin, empty it and restart.

4. 4

   Check the other persistence places

   In System Settings > General > Login Items & Extensions, remove unknown items and switch off unknown ones under Allow in the Background. Then open General > Device Management (Profiles on older macOS) and remove any profile you did not install. Browser extensions are covered in the next section.

5. 5

   Restart, look again, and change passwords

   Restart and run the checks again: a launch item that came back means another file is recreating it. Change the passwords saved in your browser and Keychain from another device, and turn on two-factor sign-in where you can.

We did not run these steps on a real infection, so we cannot tell you what the files of a specific fake look like, and we do not list file names for any family. Do not copy file lists from pages that do not say where they got them.

Scan, reset the browsers, and what a scan cannot do

A scan is a sensible step after a failed check or a risky install. It is one step, not a cure, and neither we nor any vendor can promise that a tool removes a named file.

1. 1

   Update macOS first

   Open System Settings > General > Software Update. Updates carry Apple's own malware protection (XProtect), which is separate from any app you install.

2. 2

   Run a scan with a Mac security product you trust

   Pick a product from a vendor you can check, scan the whole Mac and read what it lists before it deletes anything. The scan finds files a manual check can miss, such as an item in a folder you did not look in. A scan result that says nothing found is not proof either, so keep the path, signature and launch item checks as well.

3. 3

   Do not use a cleaner to "repair system files"

   The old advice to run a repair or optimizer tool afterwards was written for Windows. A Mac has no registry to repair, and a tool that edits system files is more of a risk than the problem. If macOS itself misbehaves after an infection, reinstall it from Recovery.