Do you have a security soft on your mac?

[Pakaku]

Nothing but LittleSnitch, uBlock Origin, and NoScript for Firefox for me.

 

[KALLT]

Keeping the system up-to-date (that also means upgrading macOS to a newer major version, at the latest when security updates are no longer released) and enabling and using the security features macOS provides gets you 99% there. For the rest, a little common sense is all you need, e.g. don’t ignore warnings without good reason, pay attention to where you obtain your software from, protect your data via backups.

I have not found any benefit in additional security tools except for Little Snitch (I use it for privacy, not security), given that I am selective about the tools I install, careful about where I install them from, generally against opening/allowing software that is not code-signed and notarised unless I know the specific reason for it (e.g. open-source software that is not signed for cost reasons or old software that was never signed, but still works) and overall just careful which sites I am visiting. In my experience, most adware/malware comes from shady tools or shady sources (torrents or websites that provided cracked versions), which can be avoided altogether.

 

[KaliYoni]

Looks like using only Apple XProtect for malware protection isn't a good idea:

Massive New AdLoad Campaign Goes Entirely Undetected By Apple's XProtect - SentinelLabs

Learn how to detect the latest variant of this widespread adware and browser hijacker, its infection pattern and indicators of compromise.

labs.sentinelone.com

 

[Big Bad D]

You should not install any active monitoring software. It is unnecessary and will only cause problems. It adds no benefit. I use the Malwarebytes free version and my head when I am online. I've never had malware on my machines. A manual scan every week or month or whenever you remember should be sufficient. The best defense of all is to just be aware of where you are and what you are doing. Treat links with a healthy does of skepticism. Don't become a sucker.

Active monitoring software might not be necessary for all users. But it does not normally cause problems.

Malwarebytes is well recommended and no issue with free version. Personally I chose to support the product with the paid active monitoring version - that’s my choice - and it does not cause problems, but runs quietly and efficiently in the background doing its job without requiring manual periodic action.

I do fully agree that user common sense is strongest factor in defense.