My mouse started moving around my screen on its own

Basically just that. While I was working this afternoon, my mouse started moving around on its own like a user had remotely accessed my desktop. I immediately shutdown the device, restarted and disabled wifi and then went about trying to figure out how this happened. I'm running an M1 Pro 16' Macbook.


Screen sharing and all other sharing settings were off. The "allow access" box had "Administrators" listed, which I removed. There is only one user account associated with this device. I ran a virus scan that found nothing. I turned Apples trusted app filter back on. There is no evidence that anyone has accessed my icloud account but I did update my password. Oh, and I completed the security updates for MacOs that I had been putting of.


I noticed several weeks ago that I was getting a your "screen is being observed" notification while the device was locked and eventually isolated the problem to Safari but assumed this was just a bug from when I was screen sharing in the browser during a conference call earlier. Anyways, I think I've probably been hacked but not sure what my next steps should be to address the problem.

MacBook Pro 16″, macOS 14.5

Posted on May 23, 2024 7:26 PM

Reply

Similar questions

13 replies

May 24, 2024 8:24 PM in response to jerik19

In addition to your valid concern that someone may have had remote access to that Mac, there is at least one additional reason to completely erase that Mac and reconfigure it from the ground up, and that's due to having apparently used "CleanMyMac" at some time.


Other concerns are evident:


/etc/hosts - Count: 1


Why?


Erase that Mac. Follow these instructions: Erase your Mac and reset it to factory settings - Apple Support.


When repopulating its contents from its Time Machine backup, choose a date prior to the intrusive event:


Backup:
Time Machine information is limited without Full Disk Access


We don't know what that date might be.

May 25, 2024 1:23 AM in response to jerik19

I concur with the assessment from @ John Galt regarding " CleanMyMac " aka " BrickMyMac "


There also appears that some Outdated Software that has been migrated form previous installation on another computer


The mix of CMM and outdated software spells and go mix and may be the source of many issues including the Mouse Issue


Start over as previous suggested


This time, do your best not to Migrate Older software but to install the current versions


Factor in the Apple Silicon aspect, were the newer software is using Universal Binary Software. 


It contains Both Intel and M1/ M2 / M3 ARMs binary code and refer to (  Universal 2 ).


When the user installs a 64 bit Application that contains Both Intel and M1 / M2/ M3  ARMs binaries - depending on factors, the Operating System may or may not invoke Rosetta 2.





May 25, 2024 2:49 PM in response to jerik19

The report indicates the presence of an extraneous entry. It may or may not be meaningful, but read Fixing a hacked /etc/hosts file - Apple Community. It explains what the Hosts file is used for, and how to fix it if it has been altered.


There are no references to JavaScript, which is completely unrelated to Java. It's the latter that appears to be old. It also may or may not be meaningful, but like anything else you choose to install on a Mac it's up to you to keep it updated.


There are still a lot of extraneous and unnecessary system modifications present. The report states:


System modifications - There are a large number of system modifications running in the background.


Any one of them can cause unexpected behaviour. You need to ask yourself what you need, and what you don't.


CleanMyMac also appears to remain, and is still affecting that Mac to an unknown extent. It has been my experience that the most expedient solution to having used it (or similarly categorized junk) is to erase the affected Mac.

May 24, 2024 1:39 AM in response to jerik19

jerik19 wrote:

Basically just that. While I was working this afternoon, my mouse started moving around on its own like a user had remotely accessed my desktop. I immediately shutdown the device, restarted and disabled wifi and then went about trying to figure out how this happened. I'm running an M1 Pro 16' Macbook.

Screen sharing and all other sharing settings were off. The "allow access" box had "Administrators" listed, which I removed. There is only one user account associated with this device. I ran a virus scan that found nothing. I turned Apples trusted app filter back on. There is no evidence that anyone has accessed my icloud account but I did update my password. Oh, and I completed the security updates for MacOs that I had been putting of.

I noticed several weeks ago that I was getting a your "screen is being observed" notification while the device was locked and eventually isolated the problem to Safari but assumed this was just a bug from when I was screen sharing in the browser during a conference call earlier. Anyways, I think I've probably been hacked but not sure what my next steps should be to address the problem.

Third Party Security Software to " ran a virus scan "


The Mouse Jumping around uncontrollable could be associated with the Virus Scanner used on this computer.


There are no known Windows-like Viruses in the wild that self replicate and affect macOS, because of the underling UNIX  Foundation and Permission Limitation. 


The Operating System resides in a Sealed and Read Only Volume that cannot be opened by the User nor by Third Party Applications.


The only Entity that can open and modify or alter this Volume is Apple.


As for Hacking ?


This would have required the " Hacker " to have gained Physical and Direct Access to this computer.


They would have had to somehow, either bypassed your Strong Password for the Admin account or to have known / guessed the password.


Thereafter, to have installed their " Hacking " Method or Software to take full control of this computer

May 24, 2024 8:45 AM in response to Owl-53

what if I unwittingly installed software or downloaded files that could allow some kind of backdoor access? how do you explain the "your screen is being observed" I encountered while using safari?


would you be willing to take a look at an etrecheck report? There is an item in there around the time I experienced mouse movements that I did not input regarding high cpu use from com.apple.WebKit.WebContent around the time this happened. I know there were some known webkit vulnerabilities that were patched in this month's security updates.


I suppose there are more likely causes for this behavior than "hacking" or malware. Maybe I'm just being paranoid. But this line in my etrecheck report seems really weird to me and the log correlates with the time I experienced the strange behavior.



May 26, 2024 10:47 AM in response to John Galt

Ok that all makes sense. I appreciate the background information about the etc/hosts file you linked. I've certainly learned some lessons about how to keep my devices healthy over time from this experience.


I've done a factory reset of the device. Everything seems to be working normally now. With the factory reset, do you think it is safe to use this device moving forward? I have changed passwords as a precaution but haven't seen any unusual logins or anything along those lines. Should I take any other action at this point?


Thanks again for your assistance.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

My mouse started moving around my screen on its own

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.