Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

My Mac is hacked

For the last 5 years my old mac & new mac has been hacked. It has control of my mouse, can see my screen and can access many of my files. It has done many strange things over the course of the last 5 years, except criminal activity such as removing money from my bank account.


The presence of this hacker is supported by my friends and family. It was installed at the same time I was diagnosed with Aspergers (this is a long story). I have tried many things to rid myself of its presence as I have the human right to live hacker-free. I believe this hacking is very sophisticated. The last security expert told me this type of hacking is not a virus, but as he worked in corporate he was not interested to help me. Other experts specialise in Windows.

MacBook Pro with Retina display, OS X Yosemite (10.10.1)

Posted on Dec 7, 2014 3:20 AM

Reply
22 replies

Dec 7, 2014 5:07 AM in response to AdriennaZ

I see lots of people who say they have been hacked. It is extraordinarily rare that they are actually right. More often, they are misinterpreting some normal event or some common (or uncommon) problem that is not hacking related. Of course, hacking isn't strictly impossible, either. So, we need you to describe your problem in more detail. What exactly are you seeing that makes you believe you have been hacked?

Dec 7, 2014 5:30 AM in response to thomas_r.

I have been a mac user for approximately 7 years. My first mac as the old Macbook Pro 17" and what a great machine it was. Too bad Apple don't make that size anymore. So when the hacker first arrived, it was easy for me to see these differences:


1. The hacker has control of my mouse. It can move my mouse to any part of the screen and does so regularly

2. When I open certain MS word docs, it can move the scroll bar up and down with me just sitting back and watching this go one.

3. For a very long time, the hacker's antics made it impossible for me to work. I used to publish a magazine using Adobe Indesign. The hacker would not allow me to use my cursor so that I could actually work. I recently closed down my business because of the hacker.

4. I have gone to the Apple shop to double check the cursor just in case I was going mad. I had complete control of the cursor when using a demo mac in an Apple shop.

5. The hacker removes files, and changes things around.

6. I went to this website: http://www.stigviewer.com/stig/mac_osx_10.6_workstation_draft/ and some of the things I tested I did not see the results I should have. No sure having the latest mac with Yosemite makes much difference.

7. There have been a few times, when the cursor has moved by itself, with me just sitting back and watching it.

8. The hacker has used my screen and the icons on the screen in order to communicate certain concepts and themes

9. When I write emails or letters, it will move my cursor to certain parts of the screen to communicate its approval or disapproval.

Dec 7, 2014 6:06 AM in response to AdriennaZ

Sounds like the predominant theme is that your cursor is moving around on its own, which is almost a guarantee that you haven't been hacked - or if you have, it's by a very amateurish hacker, probably with physical access to the machine or with access to your Apple ID. For some possible explanations, see:


My mouse keeps moving around on its own, as if someone is remotely controlling my Mac!


Since you mention that the problem didn't occur at the Genius Bar, it's possible that the problem is caused by some Bluetooth device at your home or office. Or it could just be that it's too sporadic to appear when you want it to. 🙂


(Fair disclosure: I may receive compensation from links to my sites, TheSafeMac.com and AdwareMedic.com, in the form of buttons allowing for donations. Donations are not required to use my site or software.)

Dec 7, 2014 6:25 AM in response to AdriennaZ

I have spoken to security experts who also suggested erasing the hard drive and re-installing the system. This has been done 2 times with the old mac. No difference. Hmmm the link you sent suggests no solution "And there is no anti-virus software in existence that will find and remove all possible sources of access, since a back door could be left using entirely legitimate software, or even built-in Mac OS X functionality".


In regards to 'Genius Bar' I have spoken to several mac shops whilst in Australia last year (I live in Thailand), and was directed to a mac specialist. Where I spent some hundreds of dollars erasing the harddrive and re-installing the system, plus trying to get to the root of the problem.


Sorry, but I can't accept there are no solutions, nor do I believe this is an amateur hacker.. Thanks for all your help.

Dec 7, 2014 6:32 AM in response to AdriennaZ

I'm not sure why you think the link I gave you proposes no solutions. There are MANY possible solutions proposed there. The fact that anti-virus software is not a solution does not mean that there are no solutions.


The fact that you have already erased your hard drive and reinstalled the system is further evidence that this is not a hack. If anything malicious had been installed, this would remove it, unless it was done improperly and system components or settings files were restored from backup.

Dec 7, 2014 6:50 AM in response to thomas_r.

From OP


7. There have been a few times, when the cursor has moved by itself, with me just sitting back and watching it.

8. The hacker has used my screen and the icons on the screen in order to communicate certain concepts and themes

9. When I write emails or letters, it will move my cursor to certain parts of the screen to communicate its approval or disapproval.





Let's be honest, isn't this really the kind of virus we would all like to have? Something that lets the user sit back and watch, while it communicates concepts and themes and communicates its approval or disapproval to incoming email without intervention on user part. 😀

Dec 7, 2014 6:57 AM in response to Sparkleberry

Sparkleberry, you're a real funny guy. It wouldn't be so bad if it didn't stop you from working. If a normal task takes 3 hours, with this hacker now takes 8. Or if you end up closing down your business because it's all too much. And you're forgetting the 'concepts, themes and mindf**k'. Or how about the fact that you can't think or concentrate on your work because you have no control of your cursor, do you know how distressing that can be? Yep, I know it all sounds really crazy and maybe even funny, but when it happens to you, it's not so funny and even devastating.

Dec 7, 2014 7:14 AM in response to Esquared

Good question. Initially when all this started, I turned off my wifi in order to work on some proposals in MS word. Strange to say the hacker was still here. It's something I hate to admit because several people have told me it's impossible except for one security expert (who only did corporate work, had no interest to spend time with a self-employed person and because he had no experience with macs). I have just tried it now and it seems no hacker. The bluetooth connection is disabled.


I used to have the world's largest database of Asian food regulations and my customers were some very big and medium size food companies plus some governments. Like most start-ups I had limited funds and did not see this coming (please read my first post for some basic history). All attempts to rectify the security breach has failed. Besides I can't operate my business without internet connection.

Dec 7, 2014 8:02 AM in response to AdriennaZ

Good question. Initially when all this started, I turned off my wifi in order to work on some proposals in MS word. Strange to say the hacker was still here. It's something I hate to admit because several people have told me it's impossible except for one security expert.


Well, I don't think you'll find many people here that would agree with that single security expert. And even if this kind of hacking were theoretically possible, the effort would be humongous.

Dec 7, 2014 8:03 AM in response to AdriennaZ

AdriennaZ wrote:


Initially when all this started, I turned off my wifi in order to work on some proposals in MS word. Strange to say the hacker was still here. It's something I hate to admit because several people have told me it's impossible except for one security expert (who only did corporate work, had no interest to spend time with a self-employed person and because he had no experience with macs).


Then that clinches it. If wifi is off, Bluetooth is off and it's not connected to a network directly via Ethernet, and there's no cellular hardware involved for allowing wireless internet, it is literally impossible for a hacker to be controlling your Mac. The fact that you saw the behavior when there was no network connection shows that this is something else... hardware problem, software problem, etc. See the other solutions in the document I referred you to. If you get yourself stuck on thinking of this as a hack, you'll probably never find your solution.


Also, please note that I'm not trying to ridicule or dismiss you in saying this isn't a hack. I'm just trying to get you to see what the facts indicate, and help you find your way to a solution to the problem at hand.

Dec 7, 2014 8:14 AM in response to AdriennaZ

There are several possible causes for this issue. Please take each of the following steps that you haven't already tried until it's resolved. Some may not apply in your case.

1. Follow the instructions in this support article, and also this one, if applicable. A damaged or defective AC adapter could be the cause, even if it's the right kind.

2. Press down all four corners of the trackpad at once and release. If there's any effect, it's likely to be temporary, and in that case the unit must be serviced or replaced.

3. Open the Bluetooth preference pane in System Preferences and delete all pointing devices other than the trackpad, if applicable. Disconnect any USB pointing devices. By a "pointing device," I mean a peripheral that moves the cursor, such as a trackpad, mouse, trackball, or graphics tablet. A plain keyboard is not a pointing device.

4. Start up in safe mode and test, preferably without launching any third-party applications. If you don't have the problem in safe mode, but it comes back when you restart as usual, stop here and post your results. Do the same if you can't start in safe mode. If there was no difference in safe mode, go on to the next step.

5. Reset the System Management Controller.

6. If you're using a Bluetooth trackpad or mouse, investigate potential sources of interference, including USB 3 devices.

7. A swollen battery in a portable computer can impinge on the trackpad from below and cause erratic behavior. If you have trouble clicking the trackpad, this is likely the reason. The battery must be replaced without delay.

8. A defective peripheral device or a damaged cable can cause the built-in trackpad of a MacBook to behave erratically. If you're using any wired peripherals, disconnect them one at a time and test.

9. There's also a report of erratic cursor movements caused by an external display that was connected but not turned on.

10. If none of the above applies, or if you have another reason to think that your computer is being remotely controlled, remove it from the network by turning off Wi-Fi (or your Wi-Fi access point), disconnecting from a Bluetooth network link, and unplugging the Ethernet cable or USB modem, whichever is applicable. If the cursor movements stop at once, you should suspect an intrusion.

11. Make a "Genius" appointment at an Apple Store to have the machine and/or external trackpad tested.

Dec 7, 2014 8:37 AM in response to Linc Davis

Thanks for this. However there appears to be a lot of focus on the mouse (for good reason) as the sole question as to whether this hacker exists or not (I don't use the trackpad as I developed RSI due to the considerable amount of time I used to spend building my database). I am now on my 3rd mouse thinking it was mouse problems.


So how you do explain files that have been moved. Or the time (about 3.5 years ago) when a client contacted me and as I needed to review previous emails there was no content. All text had been removed. The emails were also in Time machine but they too had no content. Freaky don't you think?


How do you remove all text from emails sent by other people over a 6 month period? Or yesterday when I renamed a file in Mail and today is it moved? Or my accounting program in finder that used to have an icon now has a black box? When you live with this kind of stuff and then have a hacker that moves your cursor to suggest BS, its all very distressing.

My Mac is hacked

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.