What is RTProtectionDaemon on Mac?

Where it lives

Inside Malwarebytes' own folder, at /Library/Application Support/Malwarebytes/MBAM/Engine.bundle/Contents/PlugIns/RTProtectionDaemon.app. It runs whenever Malware Protection is on in Malwarebytes, whether or not the Malwarebytes window is open, which is why it shows up in Activity Monitor on its own.

To see where the running copy is and who signed it:

ps -axo pid,%cpu,rss,command | grep [R]TProtection
codesign -dv --verbose=2 "/Library/Application Support/Malwarebytes/MBAM/Engine.bundle/Contents/PlugIns/RTProtectionDaemon.app" 2>&1 | grep Authority

The path should be the one above and the signature should name Malwarebytes. A process with this name anywhere else, or on a Mac where Malwarebytes was never installed, is worth a closer look.

Why it uses so much CPU or memory

Real-time protection checks files as they are written and opened, so it works hardest when the disk is busy: a large download, a backup, a build, a sync. Malwarebytes' own forum has years of reports of it taking most of a CPU core, and of its memory growing over days. A newer version is the usual fix. If it stays high:

• Update Malwarebytes from its own menu, then restart the Mac.
• Turn off Malware Protection (its real-time protection) in Malwarebytes. The daemon stops; manual scans still work.
• Uninstall Malwarebytes with its own uninstaller if you no longer want it. Dragging the app to the Trash leaves the daemon and its folder behind.

Quitting the process in Activity Monitor only helps until Malwarebytes starts it again.

Do I need it?

That is your call, and Malwarebytes is a reputable product. It helps to know what is already there: macOS checks every app against Apple's malware definitions and removes known families in the background, at no cost. See whether a Mac needs an antivirus and what XProtect Remediator does.

Where the app comes in

RefreshYourMac does not scan for malware, so it does not compete with Malwarebytes or replace it. Its CPU and memory readings name the busiest process on the processor, so a daemon running hot is easy to spot, and its Maintenance screen reads your Mac's own protection: the XProtect version and whether Gatekeeper is on. See CPU and memory and malware protection.