Two good friends have recently had their Apple macOS machines infected with annoying malware and I'm pretty sure the vector was downloading and installing (with authentication) fake updates to Adobe Flash.
I saw this amazing display recently, all on one page.
Use of Flash is almost zero these days and if you really need it I suggest running the Chrome browser which has it built-in.
If you think you have malware on your computer, I can recommend ClamAV which is open source and free. Friend Gerald said that ClamAV didn't find everything though "So it looks like ComboCleaner finds threats that ClamAV does not. Although CC won't delete them, but uses the fear to promote subscription."
He's technical so once he had a name of something found by ComboCleaner he used find / -name XXX to find the path to each suspect file and then deleted them manually.
Having said all that, I don't run a virus checker on my Macs and haven't had trouble, but that's partly because I'm very skeptical of things I install from the internet.