Is my Mac hacked? How to check, setting by setting

MacUpdated 14 October 2026

Maybe the Mac has been acting oddly, or an app you don't remember installing turned up. You can check most of this yourself in System Settings. One odd symptom on its own proves little. A setting or app you don't recognise tells you much more. (For laptops in general, see how to tell if your laptop is hacked.)

Quick answer

Check System Settings > General > Login Items & Extensions for things you didn't add. In Privacy & Security, look at which apps can use Screen & System Audio Recording, Accessibility, Input Monitoring, Camera and Microphone. In General > Sharing, make sure Remote Login, Remote Management and Screen Sharing are off unless you use them. Then check General > Device Management and your Apple Account devices.

If you think someone close to you has been monitoring your Mac, please don't confront them or go through their devices. Apple's Personal Safety User Guide says to consider the possible impact on your safety and privacy before you change or delete anything. In the UK, the National Domestic Abuse Helpline, run by Refuge, is on 0808 2000 247, and you can contact your local police. In an emergency, call 999.

These steps use the names in the current macOS. On older versions some differ: for example, macOS Sonoma 14 has General > Login Items, and Privacy & Security > Profiles instead of General > Device Management.

What are the signs a Mac has been hacked?

The UK's National Cyber Security Centre lists these signs that a device may be infected. None of them proves a hack on its own.

The device runs slowly, restarts by itself, or closes or opens apps you didn't touch.
Pop-ups appear from apps you don't recognise, asking you to do unexpected things.
People tell you they've had odd emails from you, advertising products or asking for money.

macOS also warns you itself. Apple says that if it detects known malware, your Mac tells you the app can't be opened and moves it to the Bin.

One sign is a scam rather than a hack: a phone call saying your computer is infected. The NCSC says to hang up and report the call to Report Fraud.

What starts automatically when I log in?

Start with the apps that open when you log in or are allowed to run in the background.

Choose Apple menu > System Settings, click General in the sidebar, then click Login Items & Extensions. You may need to scroll down.
Look through Open at Login. To remove something you don't want, select it and click the Remove button below the list.
Look through App Background Activity, which Apple describes as apps allowed to do tasks when they aren't open, such as checking for updates or syncing.
Under Extensions, check Added extensions, from third-party developers. Search the name of anything you don't recognise before turning it off.

Can an app on my Mac log my keystrokes or record my screen?

Apple says some apps can monitor your keyboard, mouse or trackpad even when you're using other apps, and some can record your screen and audio. You decide which apps are allowed, in Privacy & Security. If you're worried about keystroke logging, Input Monitoring is the list to check.

Choose Apple menu > System Settings, then click Privacy & Security in the sidebar.
Click Input Monitoring. Turn off any app you don't recognise or no longer use.
Go back and click Screen & System Audio Recording. Do the same.
Click Accessibility. Apple describes these as apps that access and control your Mac through accessibility features, and says to grant access only to apps you know and trust.
Check Camera and Microphone in the same way.

Apple also says a green light beside the built-in camera means the camera is on, and that next to the Control Centre icon in the menu bar, an orange dot means the microphone is in use, a green dot a camera, and a purple dot that system audio is being recorded.

Can someone remotely access my Mac?

Yes, if a remote access feature is switched on or someone installed a remote access app. Sharing settings include four that let another computer in. Apple says that while your screen is shared, the other person can see it, open, move and close files and windows, open apps and even restart your Mac.

Choose Apple menu > System Settings, click General in the sidebar, then click Sharing.
Check Remote Login, which allows access using SSH. Apple says allowing remote login can make your Mac less secure.
Check Remote Management, which allows access with Apple Remote Desktop.
Check Screen Sharing.
Check Remote Application Scripting. Apple says that with it on, an AppleScript program in use on another Mac can interact with your Mac.
Turn off any you don't use. If one is on and you didn't switch it on, use the info button next to it to see who is allowed access.

Sharing settings cover the features built into macOS. For remote access apps, including any someone asked you to install on a call, look in Login Items & Extensions and in Privacy & Security > Screen & System Audio Recording and Accessibility. There's more in can someone see your computer screen remotely.

Is there a profile on my Mac I don't know about?

Apple's Personal Safety User Guide says profiles and device management tools, used by schools and businesses, may allow access to data or location information on the device.

Choose Apple menu > System Settings, click General in the sidebar, then click Device Management. You may need to scroll down.
If a profile is there that shouldn't be, select it and click the Remove button, then restart the Mac.

If your Mac belongs to an employer or school, check with their IT first. Apple says that if you can't remove a profile, your Mac may be a managed computer, and that removing one deletes its settings.

Who else is signed in to my Apple Account?

A device signed in with your Apple Account can, depending on its type, change your password, receive verification codes and sync with iCloud, Apple says.

Choose Apple menu > System Settings, then click your name.
Scroll down to the list of devices and click any you don't recognise.
Click Remove from Account.

Then change your Apple Account password: System Settings > your name > Sign-In & Security > Change Password.

Can Activity Monitor show spyware?

Activity Monitor shows the processes running on your Mac, which Apple says can be apps, system apps used by macOS or background processes, and how much CPU and memory each uses. Use it to look, not to diagnose.

Open the Activity Monitor app and click CPU.
Click a column heading to sort the list, for example to see what is using the most CPU.
Choose View > Applications in last 12 hours to see which apps have run recently, or View > System Processes to see which belong to macOS.
Search the name of anything unfamiliar before you quit it.

Does a Mac need antivirus?

Apple's Platform Security Guide says macOS includes antivirus technology called XProtect, which detects and blocks known malware and is updated automatically, alongside Gatekeeper and notarisation. Keep macOS up to date in System Settings > General > Software Update.

What should I do if I still think my Mac is hacked?

Update macOS and your apps.
Remove anything you found above that you don't recognise, then change your Apple Account, email and banking passwords from a device you trust.
If antivirus can't clean a computer, the NCSC's advice is to wipe it entirely and reinstall everything, starting with the operating system, getting expert help if you need it. Then restore your files from a backup made before the problem started: the NCSC warns that rescuing data from a device that's still infected can carry the infection over. On a Mac with Apple silicon or the T2 chip, Erase All Content and Settings is in System Settings > General > Transfer or Reset. Apple says it erases your data, settings and apps but keeps the installed macOS.
If you lost money or someone misused your accounts, report it to Report Fraud, online at reportfraud.police.uk or on 0300 123 2040. In Scotland, Report Fraud says to report it to the police on 101.

A rarer case: Apple sends threat notifications to people it believes were individually targeted by mercenary spyware, and says the vast majority of users will never be targeted. For people at that kind of risk, Apple offers Lockdown Mode, available on macOS Ventura or later.

Where Failshot fits

Failshot doesn't detect hacking, malware, spyware or remote access. It covers one thing: someone using your Mac in person.

With Failshot on, it photographs whoever unlocks your Mac, then records a 5-second video. Video is on by default and can be switched off. Sound is off unless you turn it on, and the app warns you that recording someone's voice without their permission is against the law in some places.
Whoever unlocks sees Failshot's window saying the unlock was photographed, and when a video is recording. With the Mac's built-in camera, the green light comes on.
Email alerts and location are off until you turn them on. With alerts on, Failshot emails you about an unlock you don't confirm as yours, a wrong Failshot PIN or answer, or its camera access being switched off while it's on. Photos are kept on your Mac. They leave it only in email alerts and the encrypted web vault, if you turn those on, and, if you join your organisation with its invite code, encrypted for its security team too.
Switching Failshot off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password. Like any Mac app, it can still be force-quit, and then it takes no photos until it's open again. A wrong Failshot PIN or answer takes another photo.

Failshot for Mac is out now as a free download from failshot.app, for macOS 14 or later. Turning it on needs Failshot Pro, a paid subscription, with no free trial. Failshot Pro is £3.99 a month or £23.99 a year, VAT included, for as long as you stay subscribed, if you subscribe by 31 October 2026. From 1 November 2026 new subscriptions are £5.99 a month or £35.99 a year.

It doesn't photograph a wrong password at the login or lock screen, or the first login after a restart or a log out. Logging out, restarting or shutting down closes Failshot without asking for Touch ID or your Failshot PIN, and unless you've set it to start at login (Start Failshot at login is off by default), it stays off until you open it again. It watches only the Mac user account it runs in, and it needs a camera and camera access to take a photo. It is for your own Mac, or one an organisation has authorised you to manage with Failshot. iPhone, Android and Windows versions are coming soon. If your worry is that someone used your Mac while you were away, see who unlocked my Mac.

Questions people also ask

How do I check for a keylogger on my Mac?

Go to System Settings > Privacy & Security > Input Monitoring. Apple says apps listed there can be allowed to monitor your keyboard, mouse or trackpad even when you're using other apps. Turn off any you don't recognise, and check Accessibility too.

Can someone access my Mac remotely without me knowing?

Remote access needs a sharing feature switched on, a remote access app installed or a device management profile. Check System Settings > General > Sharing for Remote Login, Remote Management, Screen Sharing and Remote Application Scripting, Privacy & Security > Screen & System Audio Recording and Accessibility for apps you don't recognise, and General > Device Management for profiles.

What does the purple dot on my Mac mean?

Apple says a purple dot next to the Control Centre icon means system audio is being recorded. Orange means the microphone is in use and green means a camera is. Only one dot shows at a time, so green can mean the microphone is on too. Opening Control Centre may show which apps are using them.

Does a Mac get viruses?

Apple's Platform Security Guide describes how macOS blocks and removes malware. Apple says that when macOS detects known malware, it tells you the app can't be opened and moves it to the Bin.