Use an outbound firewall like LuLu https://objective-see.org/products/lulu.html. It won't necessarily stop an infection but almost all malware wants to phone home. Explicitly approving every outbound request blocks this.