Someone Could Be Watching Your Mac Right Now. Here Are 8 Places to Check.
Remote access, hidden device profiles, a stranger on your Apple Account. Where to look on your mac, and what to do if you find something.
Every so often I wonder whether someone else can see what I do on my Mac. A notification I don’t remember, the camera light I thought I saw, a laptop left unlocked at a café for five minutes.
And it feels less far-fetched lately, now that AI makes it cheap to set up [fake chat pages] that talk Mac users into installing password-stealing malware.
Most of the time it’s nothing. But “probably nothing” doesn’t help much, so here are the places I actually check.
They’re all built into macOS, they take about fifteen minutes, and none of them need a download. If you’d rather have them checked for you, you can also run most of them at once with a Mac spy check app.
Everything below was checked on macOS 26.
1. Who can reach your Mac remotely
System Settings → General → Sharing
I look here first, because these settings let another computer see or control your Mac. The ones that matter:
- Screen Sharing lets someone see and control your screen.
- Remote Management does the same through Apple Remote Desktop, usually on work Macs.
- Remote Login lets someone run commands on your Mac over SSH.
- File Sharing lets other computers open your folders.
On a personal Mac, all four are normally off. If one is on and you didn’t turn it on, click the ⓘ button next to it to see which users are allowed, then turn it off.
2. Remote-control and monitoring apps
Open your Applications folder and look for remote-control tools: TeamViewer, AnyDesk, Splashtop, Chrome Remote Desktop and similar.
These are normal, legitimate apps. IT support uses them every day. The question is only whether you installed it. “Tech support” scam calls often end with the caller asking you to install one, and then it stays.
Apps that are sold to keep watch on a partner or a child are a different story. They’re usually built to stay out of the Applications folder, so don’t stop here. The next checks are more likely to catch them.
I’m building Aegisrook because I wanted a simpler way to see what’s happening on my own Mac: which apps can see my screen, what’s going online and what starts with it, all in one window. It’s for Mac, if you’d like to try it. Every check in this article works without it.
3. A device management profile
System Settings → General → Device Management
A device management profile lets an organisation control settings on your Mac. Work and school Macs have one, and that’s expected. A personal Mac you bought yourself usually shows nothing here.
If you see a profile you don’t recognise, click it to see who installed it and what it controls. For a second opinion, open Terminal and run:
profiles status -type enrollmentIt tells you whether the Mac is enrolled in device management.
4. Which apps can see your screen or read your keyboard
System Settings → Privacy & Security, then look at three lists:
- Screen & System Audio Recording
- Accessibility
- Input Monitoring
An app that watches what you do needs at least one of these. The short version: video calls and screenshot tools belong in the first list, window managers and password managers in the second, and almost nothing belongs in the third. Remove anything you don’t recognise.
5. Your Apple Account and its devices
System Settings → [your name], then scroll down to the list of devices.
Get Yugene’s stories in your inbox
Join Medium for free to get updates from this writer.
If someone knows your Apple Account password, they don’t need to touch your Mac at all. Their own device can receive your iMessages, photos and notes through iCloud.
Every device listed here is signed in to your account. If you see one you don’t own, click it and remove it, then change your Apple Account password from a device you trust and make sure two-factor authentication is on.
6. Location sharing
Open the Find My app and click People. Anyone listed there can see where you are. Then check System Settings → Privacy & Security → Location Services to see which apps can use your location.
7. A proxy you didn’t set
System Settings → Network → Wi-Fi, click Details next to your network, then Proxies.
A proxy sends your web traffic through another computer first. Some workplaces use one. On a home Mac, these should normally all be off. A proxy you didn’t set up is a real reason to worry, because it can let someone else see where you browse.
8. The camera and microphone dot
When the camera or microphone is on, macOS shows a green or orange dot in the menu bar, and Control Center names the app using it.
But it only shows what’s happening now, or what happened a moment ago. macOS keeps no history, so if you were away from your Mac, you won’t know which app turned on the microphone.
If you want that history, Aegisrook keeps a log of every time the camera or microphone turns on, with the app that used it. Try it for a week and look at the list. It’s usually just FaceTime and Zoom, and it’s good to know for sure.
Signs that are usually nothing
A few things worry people that usually have boring explanations:
- A hot Mac or loud fan. Usually Spotlight indexing, a backup or a browser tab.
- Fast battery drain. Same causes, plus video calls.
- A browser page saying your Mac is hacked. That’s a scam page trying to scare you into a download or a phone call. Close the tab.
On their own, these don’t mean you’re being watched. The checks above tell you much more.
If you find something
Don’t start deleting things straight away.
- If you think someone you live with or know is monitoring you, removing it can alert them. Apple’s Personal Safety User Guide has a step-by-step section on this, and it’s worth reading first.
- Change your Apple Account password from a device you trust, and check its device list again.
- Turn off the sharing setting, remove the profile or delete the app you found.
- Update macOS, then check the lists again in a day or two to see if anything came back.
Tools that make this easier
Doing all eight checks once is easy. Doing them every week is tedious, and macOS won’t tell you when something changes. Two tools help with that.
OverSight is free, from Objective-See. It alerts you when the camera or microphone turns on and names the app, which fills the gap in check 8.
Aegisrook has a Spy Check page that answers two questions every minute: is anything sending my files out, and is anything watching me? It looks for remote-control apps, monitoring software and a proxy redirecting your traffic, and it keeps a history of camera and microphone use.
It isn’t an antivirus, and it can’t tell you who is behind something. It tells you what changed, in plain words, so you know where to look. One-time purchase, two Macs per licence, macOS 14 or later.
The short version
If you only have five minutes, do these three: General → Sharing, General → Device Management, and the device list under your Apple Account. They cover the most common ways someone can keep watching a Mac without touching it again.
Want something to keep an eye on these for you? Install Aegisrook, open Spy Check and see what it finds on your Mac. If you try it, I’d love to hear what works well and what could be better.
