Macbook probably hacked - Application runs without opening

Hi,


I have noticed for the second time today something very strange. I have been watching a movie fullscreen on my Macbook. Out of nowhere my screen swipes to the left and someone have started my SSH terminal application.


This is the first time ever happening to me.


In a reflex I have disabled my WiFi.

This is very freaky...


A day earlier i thought nothings wrong but my mouse moved for a second.


What can I do? Can someone give me advice?


MacBook Pro 15″, macOS 11.2

Posted on Feb 12, 2021 7:17 PM

Reply
Question marked as Top-ranking reply

Posted on Feb 13, 2021 1:23 PM

A bad trackpad can make it appear like someone is accessing your laptop. I have seen a bad trackpad randomly open apps and windows and move the pointer around. A bad trackpad can be caused by moisture on the trackpad, a swelling battery, or just a normal trackpad failure. A trackpad failure can sometimes be very intermittent and may take a while to manifest again. Just something to keep in mind.


You can run MalwareBytes to see if you have any malicious software installed and you can run EtreCheck as well. Post the EtreCheck report here using the "Additional Text" icon which looks like a piece of paper.


Make sure to disable Remote Management & Remote Login in the Sharing System Preferences.


See if you have the issue while booted into Safe Mode with WiFi enabled. Safe Mode disables most third party apps and all login items which should minimize the possibility of anyone remotely accessing your system through malware.



Similar questions

5 replies
Question marked as Top-ranking reply

Feb 13, 2021 1:23 PM in response to nino183

A bad trackpad can make it appear like someone is accessing your laptop. I have seen a bad trackpad randomly open apps and windows and move the pointer around. A bad trackpad can be caused by moisture on the trackpad, a swelling battery, or just a normal trackpad failure. A trackpad failure can sometimes be very intermittent and may take a while to manifest again. Just something to keep in mind.


You can run MalwareBytes to see if you have any malicious software installed and you can run EtreCheck as well. Post the EtreCheck report here using the "Additional Text" icon which looks like a piece of paper.


Make sure to disable Remote Management & Remote Login in the Sharing System Preferences.


See if you have the issue while booted into Safe Mode with WiFi enabled. Safe Mode disables most third party apps and all login items which should minimize the possibility of anyone remotely accessing your system through malware.



Feb 13, 2021 7:43 PM in response to nino183

Uninstall AVG by following the developer's instructions as anti-virus apps are not needed on a Mac (MalwareBytes is the exception because it can actually detect and remove malware from a Mac without causing other issues -- plus you can configure it not to run the real-time scanner all the time). I also recommend uninstalling the Sensei app. While it includes some monitoring features it also includes cleaning abilities which is not needed on a Mac again because it usually causes more problems than it solve plus it impacts system performance. I also don't think the Intego Content Barrier is necessary either (I don't know anything about how it interacts with a Mac, but it really should not be necessary since macOS provides a lot of built-in security without requiring any third party apps).


FYI, I won't even install AVG on Windows anymore because AVG is absolutely terrible these days (I used to use AVG on Windows 20 years ago). In fact I won't install any third party anti-virus apps on Windows anymore because they are all terrible these days (I just use the Windows built-in anti-virus).


I'm not familiar with those Safari extensions. I would definitely be careful using any browser extensions especially Chinese ones. So many browser extensions are shown to be buggy if not outright riddled with malware or they invade your privacy.


I'm also not familiar with "starstechnologies", but I'm not familiar with a lot of legitimate macOS app developers either so this may be fine -- I just don't know what it is. I believe I've seen the "imobie" tools in other reports where no one commented on any problems with this tool (again I know nothing about it).


As for a swelling battery do you detect any deformation in the case where the Bottom Case may be starting to separate from the rest of the laptop? Does the laptop sit nice & flat on a flat tabletop? Do you notice the Trackpad rising up above the level of the palmrest? Does the display close properly? The only other way to detect a swelling battery is to have an Apple technician open the laptop and actually view the battery to see if there is any swelling that hasn't yet caused the laptop to deform.


The only way to see if the Trackpad is the issue instead of a software issue or hacker is to boot from an external macOS drive or Internet Recovery Mode to see if the pointer moves on its own. However, like I said some trackpad issues are intermittent and can take time to occur again and it sometimes requires actively using the trackpad to help trigger the failure which is hard to do from Internet Recovery Mode so an external macOS boot drive is best for testing purposes. You can install macOS to an external USB drive by booting into Internet Recovery Mode or by using a bootable macOS USB installer.


Of course you can always restore from a backup made before you encountered this issue in case it is caused by software (make sure to perform a clean install of macOS by first erasing the whole physical drive before installing macOS and restoring from backup).


Perhaps another more experienced contributor will chime in to offer some advise as well.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Macbook probably hacked - Application runs without opening

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.