Anything look sus on my Activity Monitor?

Anything on here look like it could be used to keylog or remotely view my screen or anything like that?


I tried to have the one listed at the bottom of one screenshot appear at the top of the next and there are a few duplicates where things moved up/down, just in case. I tried printing as pdf, but it was blank.


Also, for future reference, is there a way I can narrow it down without having to look everything up? Like can I rule out certain users or something?


https://www.dropbox.com/scl/fo/ufgx5p1kg5sbr4rwkw654/AK-bhpCFn1sGZxsFPHWH_bo?rlkey=hnco9b0bcaptce25yyj3enab8&dl=0

MacBook Pro 13″, macOS 12.7

Posted on Feb 6, 2025 12:48 AM

Reply
5 replies

Feb 7, 2025 1:23 PM in response to ninjaphrodite

> i need to know if there's anything out of place


I don't think anyone can answer that for you.


Sure, there are some (very few) known malware apps that might stand out, but if you're worried about your roommates, I'm guessing they're not sophisticated enough to install the heavy-duty stuff, and are much more likely to have done something like enabled Remote Desktop/Screen Sharing via System Preferences. Since that's going to be part of the standard OS install, no one here can tell if it's running nefariously, or legitimately (you might have it on for other reasons).


Similarly, there is no 'one true list' of running apps since everyone runs their system differently, with different apps for different use cases. The presence (or absence) of any application on the list doesn't tell us whether it's meant to be there or not since we don't know your use case.

Feb 6, 2025 4:30 PM in response to ninjaphrodite

ninjaphrodite wrote:

Anything on here look like it could be used to keylog or remotely view my screen or anything like that?

I tried to have the one listed at the bottom of one screenshot appear at the top of the next and there are a few duplicates where things moved up/down, just in case. I tried printing as pdf, but it was blank.

Also, for future reference, is there a way I can narrow it down without having to look everything up? Like can I rule out certain users or something?

https://www.dropbox.com/scl/fo/ufgx5p1kg5sbr4rwkw654/AK-bhpCFn1sGZxsFPHWH_bo?rlkey=hnco9b0bcaptce25yyj3enab8&dl=0


What is the issue exactly...?


What makes you suspect nefarious activity of some sort?


Is your macOS up to date?



To be honest I can not be trolling through some 32 screen shots...


You can however reach out to Apple Support— they get paid to entertain your query:


Call Customer Support (800) MY–APPLE (800–692–7753)


or on line https://getsupport.apple.com/


Outside the USA—Contact Apple for support and service by phone

See a list of Apple phone numbers around the world.

Contact Apple for support and service - Apple Support



You can erase your Machine, re-install the macOS and then restore your data from a backup prior to your suspected issue.


Erase and reinstall macOS - Apple Support - Erase and reinstall macOS - Apple Support


Restore your User data from a backup using Time Machine

Restore your Mac from a backup - Apple Support



Protecting against malware in macOS

Protecting against malware in macOS - Apple Support


Recognize and avoid phishing messages, phony ...

Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams - Apple Support


Effective defenses against malware and other threats… - Apple Community

Effective defenses against malware and ot… - Apple Community



Feb 6, 2025 4:36 PM in response to ninjaphrodite

So…what’s the central issue here? What happened?


Malware can certainly mimic legitimate apps, among other issues with this general approach toward detection. And key loggers can exist within common sorts of cables.


If you suspect a catastrophic security breach, erase and install from known-good sources, don’t restore your backups, and rotate your credentials.


Yeah, copying over files and documents from your backups is probably safe, but then it’s also possible to boot Linux inside a PDF, and other document-embedded macro languages have had issues for many years.


Feb 7, 2025 1:23 PM in response to ninjaphrodite

The issue changes nothing.


Your adversaries may be incompetent, or they may well add a backdoor that allows access.


Or they can copy credentials for later.


Or they can set up an external camera with a view to where you work.


If you suspect compromise, that means your passwords and passcodes are best assumed to be compromised, and files and scripts compromised, and that in aggregate means reinitialization, and rotating your passwords and passcodes, and don’t restore.


And even if you do find a keylogger here, everything else is quite possibly still compromised, passwords and all.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Anything look sus on my Activity Monitor?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.