Advice needed! Hacker took control of my macbook pro

Thanks Dominic but I didn't have a pop up. I had someone remotely take control of my system and who, when I discovered it, I saw manipulating files and programs before I shut the system down. To date, I've never had a pop-up problem on a mac.

Luis, thank you for your reply. Here are the answers to your questions.

For starters, who else has access to your system/s? Do your have Remote Desktop software installed or vnc/screen sharing? Do you have ssh enabled?

The only other people who rarely make use of my laptop are my wife and my sole employee - both are implicitly trusted. My employee only uses the system when were filming on location and my laptop is used to manage data from the shoots.

I do have the logmein client and chrome remote desktop installed on the system. Apple, Intuit and another third party vendor have used remote applications to share screens for tech support / demonstration purposes. Desktop sharing was not turned on, not sure if ssh was enabled or not.

What kind of network do you have?

In our studio we have a simple wired/wireless network routed through an apple airport which is connected to a cable providers modem.

Which apps were exactly being used?

Slack (desktop app) / Quicktime 7 / MacMail / Chrome Browser / Acrobat Pro / Word / Preview

I would suggest to start looking at your logs, start with /Applications/Utilities/Console

Will do - I need to boot from the clone - will do asap (need to boot from the clone) and will look at the specific times I was away from the computer.

Thank you for the thoughtful reply and useful info thomas.

The only person who was in my office at the time of the compromise was my sole employee who I implicitly trust - if he's the problem, he wouldn't have needed a remote person to access anything and he certainly would certainly have known when I was returning and would have avoided discovery. So I don't think that's it. I assume (based on everything I've learned) that an executable was inadvertently added to the system at some point, likely via a website visit (I never click on email links or open attachments unless I'm 100% sure of their origin" and the executable was "sleeping" waiting for an the right circumstances for a remote login session.

I work in a very small photo/video studio environment and I'm by far, the most technically capable person there, I also know and trust everyone who has access and we've worked together for many, many years. You never know but its highly unlikely that any of them were the culprits. None the less, laptop will be turned off and stored going forward!

I'm going to follow your reccomendations and readup on and likely enable both Firevault and firmware password. Thank you!

Thanks for following up!

Were these the apps that you used earlier in the day? In OS X, closing the last window does not always quit the app. Even though you had no windows open for these apps, is it possible the windows were minimized to the Dock and/or the apps themselves were not explicitly quit?

The reason I ask these specific questions is that occasionally I see the same results as you described. After being away from the computer, or overnight, when I return and wake the Mac, the screen is covered with a multitude of open windows.

The apps were the ones that I had open before leaving - I'm new to Slack and use it to communicate with a company I'm working with, I have been in touch with their security team and they seem certain that the hack didn't come through their app. However, I'm not going to reinstall the app just in case (it might have kept my computer from going to the lock screen, which it should have done within 2 minutes of my going idle.

The reasons I'm positive that the apps that I found open on the system when I returned had not been on previously is because I started the machine up in the morning from fully off state and definitely did not have my personal accounting software open (I don't use it as often as I should :-), plus the accounting software was open to the register for my retirement accounts AND an email from the investment company I keep them at had been opened to my desktop from macmail (I changed passwords, security questions and have two step verification with them, so not a problem), and most critically, FaceTime was open and my camera was on - I never use facetime from my laptop. Just watching the mouse move around the screen, closing / dragging windows - it was clear that someone was controlling the system. Had my facetime not been buried by mulitiple windows and my accounting software obsucred by several as well I would have noticed what was up immediately upon returning - it probably took less than a minute or two to figure it out and shut down but it there's no doubt in my mind about what happened.

Thanks for the concern and advice!

In that case, it sounds like the culprit may actually be one of your remote access apps. There should be an online account associated with both LogMeIn and Chrome Remote Desktop, and either of those accounts could have been hacked. Go change the password on both immediately! Make sure to use a strong password, and make sure to change any security questions. I'm not intimately familiar with either of these apps, but if either account offers two-factor authentication instead of security questions, use it.

I'd also recommend uninstalling one or both, if possible.

Its certainly possible! I've used lastpass for the last year and a half or so to maintain as well as often generate my passwords (not even I know most of them) and I always go for complex. I also keep my systems set to log out after 2 minutes of inactivity, so that even if you get to the desktop, you need to know the user password to get in. I've avoided reinstalling either so far and will use another system (with lastpass) to change the passwords for both. Eventually I'll need to use at least one of them but for now I'd I just want to know that my clean machine is staying as clean as possible.

Thanks!