“Your screen is being observed” Mac Message

That is a scam. Please download and use Malwarebytes and it should be removed. Also please read Avoid phishing emails, fake 'virus' alerts, phony support calls, and other scams

From one online forum:

Person 1: Seems to be tied to applications having screen recording permission. I revoked it from my display link manager and the message was gone. When I re-enabled the permission the message returned

Person 2: Ah thanks dude, it was that :)

Person 2: It was my DisplayLink as well. Freaked me out ... what an ominous message!

The thing is I use a DisplayLink adapter to enable a 3rd external monitor for my 13" MacBook Pro - it's always connected at my desk. The problem with this persistent error for something I do want, is that if something I don't want to record my screen tries to, I might not notice the difference.

From this, I would guess the message is from the OS, letting you know an app being loaded at startup is monitoring screen activity. You would need to find out what it is (or more than one) and disable it/them.

Also, check the System Preferences under Sharing. Screen Sharing may be on. If so, turn it off.

Where is the 'display link manager"?

That person was referring to a third party app. It was just an example of something that wants control of the screen.

I got a similar message just today when I wanted to pick up a color with the eye dropper in Muse. Had to go into the System Preferences to allow Muse access to a simple color pick.

You need to check what software on your end is trying to access the screen.

Try checking the icons in your top menu bar to see if a screen recording is happening. I saw the same message a few hours after triggering a screen recording with CMD + Shift + 5. I was able to close the recording, and the message on the Lock Screen disappeared.

Hi Kurt, I'm completely new to Mac. I was also having the same issue on my new personal MacBook Pro just now and it really sketched me out. How do I find out and also revoke which apps or software on my end are trying to access my screen? Is there a centralized hub for this and where is it located, if you wouldn't mind helping me out? Again, completely new to Mac OS.

The OS or any apps written by Apple included with it will not produce such errors. Such as, a simple full screen shot keyboard command of Command+Shift+3 will produce no error even though it is obviously accessing the screen. The luxury of being able to declare yourself safe.

This means you need to find out what third party software you've installed is causing the message to appear.

Are you seeing this as soon as you turn your Mac on, or when you're trying to use a specific app? If the former, it may be the drivers for a Wacom, or other brand of tablet. As an example, the Wacom drivers in Big Sur have just the one entry that needs to be declared "safe" by you in System Preferences > Security & Privacy under the Privacy tab. There are more of them for Wacom in Catalina.

Another way to check is to see what startup daemons have been added by third party software you've installed. These entries exist as one method to cause an app to load as the Mac starts up. Entries in the .plist files point to the app, or sub-app buried within an app. Whichever they are, the OS acts on and loads them at startup.

There are three locations. If you double click the main drive icon on your desktop, the first two are in the Library folder next to Applications, System and Users.

/Library/LaunchAgents

/Library/LaunchDaemons

The last is in your user account. The tilde ~ means your account. Not the main Library folder.

~/Library/LaunchAgents

I have these in Catalina:

/Library/LaunchAgents

com.adobe.AdobeCreativeCloud.plist

com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a23d420d.plist

com.adobe.ccxprocess.plist

com.adobe.GC.AGM.plist

com.adobe.GC.Invoker-1.0.plist

com.microsoft.update.agent.plist

com.wacom.DataStoreMgr.plist

com.wacom.IOManager.plist

com.wacom.wacomtablet.plist

com.xrite.device.softwareupdate.plist

com.xrite.i1Profiler.tray.plist

/Library/LaunchDaemons

com.adobe.acc.installer.v2.plist

com.adobe.agsservice.plist

com.adobe.ARMDC.Communicator.plist

com.adobe.ARMDC.SMJobBlessHelper.plist

com.aladdin.aksusbd.plist

com.aladdin.hasplmd.plist

com.bombich.ccchelper.plist

com.charlessoft.pacifist.helper.plist

com.empiatech.cmio.DPA.plist

com.github.IngmarStein.Monolingual.Helper.plist

com.microsoft.autoupdate.helper.plist

com.microsoft.office.licensingV2.helper.plist

com.prosofteng.DRInstaller.plist

com.quark.quarkupdate.quhelper.plist

com.quark.QXPHelper.plist

com.twocanoes.WincloneHelper.plist

com.wacom.displayhelper.plist

com.wacom.UpdateHelper.plist

com.xrite.device.xrdd.plist

com.xrite.device.xrdd.restart.plist

~/Library/LaunchAgents

com.adobe.GC.Invoker-1.0.plist

com.linotype.FontFolderProtector.plist

As you can see, there can be quite a few. The only ones I have that would have anything to do with screen access would be for the Wacom tablet. The rest launch services and helpers that need to be active for each third party app listed to run when launched. A lot of them are just services that check in the background for updates for each respective app.

Since we can't see your system, this is decent info to give you an idea where to start looking.

I got this after using Airplay screen mirroring, leaving my laptop for a while & then returning.

I'm assuming it has to do with Airplay (I hope).

I have a 3rd Monitor using a hub with DisplayLink. The DisplayLink software needs Screen Recording permission to function. According to DisplayLink's website: "requires the user to permit "Screen Recording" in order for DisplayLink devices to work properly. The message is generated by the OS and the screen is not actually being recorded by DisplayLink. Approving it enables the DisplayLink driver to access the pixels it needs to render a mirrored or extended screens, and send the pixels over USB from your computer to the DisplayLink display. It does not send any data or pixels back to DisplayLink."

If you don't use DisplayLink then look in System Preferences, Security & Privacy then Screen Recording and see if any apps are listed. If so, revoke screen recording to see if the message goes away.

I also got this message while using AirPlay to use my Apple TV as a separate display (not mirroring). When I disconnected AirPlay the message on the lock screen went away.

A couple of teachers at my school reported this error, and it turns out it was caused by the Screencastify Chrome Browser extension.

why does the message appear went I sign-on to my mac "the screen is being observed"

Thanks craigfay. I stepped away and when I returned to the lock screen, I saw the unnerving message "your screen is being observed." Your advice was perfect in my situation, as that was indeed the case for me—I had turned on screen recording and then forgotten to turn it off.