Under allow in the background - a service is called "Audio Hijack"

I was looking at the section in mac settings where it lists all the apps that are allowed to run when not open, and I saw a service which was just titled "Audio Hijack". The description is "1 item: 1 item affects all users" and it has no icon. I removed it of course but is this a normal mac thing or was it something malicious?

MacBook Air 13″, macOS 13.0

Posted on Nov 29, 2022 3:54 PM

Similar questions

Audio Hijack found in Settings I found a listing for Audio Hijack in the Settings app: Settings>General>Login Items It is listed as a background app. I've never installed Audio Hijack and the only third-party audio app installed is the seemingly benign SomaFM radio app. Any thoughts?
2181 3
Why does the Music app open unexpectedly on my Mac? An unrequested start of the Music app occurred on my 2015 MacBook Pro/MacOS 12.7.6. I had joined a Teams meeting and connected a headset via Bluetooth. The Music app opened and started playing music from my library via the headset. I would like to remove the Music app as I do not see a way to prevent this from occurring again, however, I am unable to drag the application to the trash bin. Seems like I may have to ditch this computer and go back to Windows for work use. [Re-Titled by Moderator]
1132 1
What is ZhuGeSupport.framework service on macOS? Hi, a similar question has already been asked in "The mystery of ZhuGe Service?" thread. Though, it was suggested that this services was "just a part of coreaudio", it still looks suspicious. Especially when checking the list of allowed permissions that it has: $ codesign -d --entitlements - /System/Library/PrivateFrameworks/ZhuGeSupport.framework/Versions/A/XPCServices/ZhuGeService.xpc/Contents/MacOS/ZhuGeService Full list doesn't fit here, but here are just some of them: [String] RosalineSerialNumber [String] RoswellChipID [String] SavageChipID [String] SavageInfo [String] SavageSerialNumber [String] SavageUID [String] ScreenSerialNumber [String] SecondaryBluetoothMacAddress [String] SecondaryBluetoothMacAddressData [String] SecondaryEthernetMacAddress [String] SecondaryEthernetMacAddressData [String] SecondaryWifiMacAddress [String] SecondaryWifiMacAddressData [String] SecureElementID [String] SerialNumber [String] SysCfg [String] SysCfgDict [String] ThreadRadioMacAddress [String] ThreadRadioMacAddress64Bit [String] ThreadRadioMacAddress64BitData [String] ThreadRadioMacAddressData [String] TopModuleAuthChipID [String] TristarID [String] UniqueChipID [String] UniqueDeviceID [String] UniqueDeviceIDData [String] WifiAddress [String] WifiAddressData [String] WirelessBoardSnum Why would a "mere audio service" need to access all the available hardware identifiers? Or the real purpose of this service is something else, like reporting and tracking the user identification / fingerprint? And who gets this information? The name of the service suggests it has some Chinese roots... It's very strange to see such unusual naming choice for a core service, if it's really a core service. Although, it's reported as being signed by Apple, but that only raises more questions: $ codesign -d -vv /System/Library/PrivateFrameworks/ZhuGeSupport.framework/Versions/A/XPCServices/ZhuGeService.xpc/Contents/MacOS/ZhuGeService Executable=/System/Library/PrivateFrameworks/ZhuGeSupport.framework/Versions/A/XPCServices/ZhuGeService.xpc/Contents/MacOS/ZhuGeService Identifier=com.apple.ZhuGeService Format=bundle with Mach-O universal (x86_64 arm64e) CodeDirectory v=20400 size=1743 flags=0x0(none) hashes=44+7 location=embedded Platform identifier=13 Signature size=4442 Authority=Software Signing Authority=Apple Code Signing Certification Authority Authority=Apple Root CA Signed Time=Jun 18, 2022 at 3:57:35 AM Info.plist entries=21 TeamIdentifier=not set Sealed Resources version=2 rules=2 files=0 Internal requirements count=1 size=72
5398 5

1 reply

dialabrain

Level 10

137,603 points

Nov 29, 2022 4:00 PM in response to kirstensnow

Audio Hijack is a normal third-party app someone had to install. You can get an idea what it is used for from the site…

https://rogueamoeba.com/audiohijack/

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Under allow in the background - a service is called "Audio Hijack"