LightAtom

How to Tell If Your Mac Is Hacked: Network Signs

Most odd behaviour isn't a hack. These checks look at what actually matters, what your Mac connects to, what starts automatically and who can log in, so you can tell.

Something feels off: unexpected network activity, a slow Mac, settings you didn't change. You want to know whether someone has access to your Mac.

  • Heavy upload activity when you're not doing anything.
  • Unknown processes, login items or profiles.
  • DNS or proxy settings you didn't set.
  • Screen Sharing or Remote Login turned on without your knowledge.

Quick fix

Check four places, in this order:

  1. System Settings › General › Sharing: Screen Sharing, Remote Login and Remote Management should be off unless you use them.
  2. System Settings › General › Device Management: profiles you didn't install should be removed.
  3. System Settings › General › Login Items & Extensions: look for unknown apps, background items and network extensions.
  4. Network activity: look at what each app connects to and how much it uploads.

Why it happens

Normal macOS and app activity (iCloud, updates, Spotlight, sync) that looks suspicious.Most likely
Adware or a browser extension injecting ads or redirecting searches.Sometimes
A management or monitoring profile installed by someone with access.Rarely
Remote-access software or malware.Rarely

Fixes

  1. Review sharing and accounts

    1. System Settings › General › Sharing: turn off anything you don't use.
    2. System Settings › Users & Groups: remove admin accounts you don't recognise.

  2. Review what starts automatically

    1. Login Items & Extensions: disable unknown entries; look up names before removing system items.
    2. Objective-See's free KnockKnock lists everything persistent on the Mac in one window.

  3. Check DNS, proxy and profiles

    1. System Settings › Network › Details: DNS and Proxies should be what you or your organisation set.
    2. Remove unknown profiles in Device Management.

  4. Look at network activity

    1. Activity Monitor's Network tab shows bytes per process; nettop -P shows live traffic.
    2. Unknown processes uploading a lot when idle deserve a closer look; system names like mDNSResponder, nsurlsessiond and rapportd are normal.

  5. Clean up browsers

    1. Remove extensions you don't recognise and reset the browser's search engine and home page.

Still not working?

If you find remote-access tools or profiles you didn't install, change your Apple Account and email passwords from a different device, turn on two-factor authentication, back up your files, and consider erasing and reinstalling macOS. On a work Mac, talk to IT first: management profiles there are normal.

See it in the app

LightAtom's connections view lists every process with a network connection, the domain it talks to and how much it uploads, and the Map shows where. Unknown apps sending data stand out quickly.

Frequently asked questions

How can I tell if someone is remotely accessing my Mac?

Check System Settings › General › Sharing for Screen Sharing, Remote Login and Remote Management, look for a screen-recording indicator in the menu bar, and look for connections from remote-access apps in your network activity.

Does macOS have built-in malware protection?

Yes: Gatekeeper, notarization and XProtect check apps and remove known malware automatically. They catch most common threats but not everything.

Is macOS telemetry a sign of hacking?

No. macOS and apps contact Apple and vendors for updates, iCloud, analytics (if allowed) and services. You can limit analytics in Privacy & Security › Analytics & Improvements.

Should I erase my Mac if I think it's hacked?

Only if you find real evidence, like unknown remote-access tools, profiles or admin users. Then back up your files, erase, reinstall macOS and restore only your documents.

Related

LightAtom team

The people who build LightAtom, a network monitor for macOS.