Someone Controlling Your Mac Remotely? Fix Unauthorized Access Now

What Causes This Issue

Reports across the Apple Support Community describe a unsettling sensation: the cursor moves on its own, windows open without input, or text appears in active fields. This points to unauthorized remote access. Several legitimate macOS features enable remote control — Screen Sharing, Remote Login (SSH), Remote Management (ARD), and AirPlay Receiver — and any can be exploited if credentials are compromised or settings misconfigured.

Malicious actors often gain entry through phished Apple ID credentials, reused passwords from breaches, or by tricking users into installing MDM profiles or remote access trojans disguised as legitimate apps. In household or workplace settings, a former partner, family member, or ex-employee may retain access they were never properly revoked. macOS also permits local network connections from other Apple devices via AirPlay to Mac, which can activate unintentionally.

Hardware compromise is rarer but possible: a hardware keylogger on a desktop Mac, or a compromised Thunderbolt/USB-C dock with DMA access. Most cases, however, stem from software configuration gaps that users can audit and close.

Step-by-Step Fixes

1. Lock down Screen Sharing and Remote Management. Open System Settings → General → Sharing. Toggle off Screen Sharing, Remote Login, and Remote Management. If any must stay on, click the info (i) button and restrict access to “Only these users” — add only your admin account. Remove any unknown accounts immediately.
2. Revoke AirPlay Receiver access. In System Settings → General → AirDrop & Handoff, set AirPlay Receiver to “Current User” or “Off.” This prevents nearby devices from mirroring to or controlling your Mac without explicit approval.
3. Audit Apple ID devices and trusted phone numbers. On a trusted device, open Settings → [Your Name] → Devices. Remove any Mac, iPhone, or iPad you don’t recognize. Change your Apple ID password at appleid.apple.com, enable two-factor authentication if not already active, and review trusted phone numbers — delete any you don’t own.
4. Check for unknown MDM profiles. In System Settings → General → Device Management (or Profiles), look for any configuration profile you didn’t install. Corporate or school profiles are normal if you enrolled; anything else is suspicious. Select it and click Remove Profile. You may need the profile’s removal password — if you don’t have it, this is a red flag.
5. Run a full malware scan. Use Apple’s built-in XProtect (automatic) and supplement with a reputable scanner like Malwarebytes for Mac (free) or Objective-See’s free tools (KnockKnock, BlockBlock). Check LaunchAgents, LaunchDaemons, and Login Items for unknown entries: ~/Library/LaunchAgents, /Library/LaunchAgents, /Library/LaunchDaemons, /System/Library/LaunchAgents, /System/Library/LaunchDaemons.
6. Reset network and Bluetooth pairings. In System Settings → Network, delete any unknown VPN or proxy configurations. In Bluetooth, remove devices you don’t own — a paired malicious keyboard or mouse can inject input. Also check System Settings → Privacy & Security → Input Monitoring and Accessibility for apps you didn’t authorize.
7. Enable Lockdown Mode if targeted. For high-risk situations (stalkerware, state-sponsored threats), activate Lockdown Mode: System Settings → Privacy & Security → Lockdown Mode. This severely restricts attack surface — disabling JIT compilation, blocking most message attachments, preventing wired connections while locked, and more. Requires restart.
8. Reinstall macOS from Recovery if compromise persists. Boot into macOS Recovery (Apple Silicon: hold power button; Intel: Command-R). Use Disk Utility to erase the startup volume (APFS), then reinstall macOS. Restore only user data from a clean backup — not system files, LaunchAgents, or profiles. This eliminates persistent kernel-level or firmware implants.

Additional Solutions

Users in the Apple Support Community have reported success with these supplementary steps:

• Monitor network connections with lsof -i in Terminal or Little Snitch. Look for unexpected outbound connections to unknown IPs on ports 22 (SSH), 5900 (VNC), 3283 (ARD), or 7000 (AirPlay).
• Disable Bonjour advertising for sharing services via Terminal: sudo defaults write /Library/Preferences/com.apple.mDNSResponder.plist NoMulticastAdvertisements -bool true then restart. This hides your Mac from casual network browsing.
• Use a firmware password (Intel Macs) or enable FileVault (all Macs) to prevent booting from external media or accessing Recovery without credentials. On Apple Silicon, FileVault is tied to your user password — ensure it’s strong.
• Audit iCloud sync settings. If someone has your Apple ID credentials, they can view your screen via Find My → Devices → [Your Mac] → Play Sound / Erase / Lock. They cannot directly control it, but they can track location and trigger remote wipe. Changing the password cuts this off.
• Check for hardware keyloggers. On Mac mini, Mac Studio, or Mac Pro, inspect USB/Thunderbolt ports for unfamiliar dongles. On laptops, this is impractical but theoretically possible via compromised dock.
• Enable audit logging. Run sudo auditctl -e 1 to start the macOS audit subsystem. Review /var/audit logs with praudit for suspicious process execution or privilege escalation attempts.

When to Contact Apple Support

Escalate to Apple Support when:

• You’ve completed all fixes above but unauthorized activity continues — this suggests a sophisticated implant, supply-chain compromise, or hardware-level issue.
• You discover an MDM profile you cannot remove because you lack the removal password. Apple can assist with profile removal on personally owned devices if you provide proof of purchase.
• Your Apple ID shows sign-ins from unknown locations even after password change and 2FA review. Request a security review from Apple’s Account Security team.
• You suspect stalkerware installed by someone with physical access. Apple’s Privacy team handles these cases discreetly.
• You need guidance on Lockdown Mode configuration for your specific threat model.

Contact via the Support app, getsupport.apple.com, or book a Genius Bar appointment. Bring the Mac, proof of purchase, and any logs you’ve collected.

FAQ

Can someone control my Mac through Find My? No. Find My allows location tracking, playing a sound, locking with a passcode, or remote erase. It does not provide live screen view or input control.

Does FileVault prevent remote access? FileVault encrypts the disk at rest. It prevents data access if the Mac is stolen or booted externally. It does not stop network-based remote access while the Mac is running and unlocked.

How do I know if Remote Management was enabled by my employer? If your Mac is enrolled in an MDM solution, you’ll see a profile under System Settings → General → Device Management. Corporate enrollment typically includes Remote Management for IT support. Personal Macs should not have this unless you installed it.

Can a compromised router cause this? A malicious router can intercept unencrypted traffic or redirect DNS, but it cannot directly control your Mac’s cursor or keyboard. However, it can serve malicious updates or phishing pages that lead to compromise. Use encrypted DNS (DoH/DoT) and verify software signatures.

What’s the difference between Screen Sharing and Remote Management? Screen Sharing uses VNC (port 5900) for basic view/control. Remote Management uses Apple Remote Desktop protocol (ports 3283, 5900) with richer features: file transfer, script execution, software installation, and detailed reporting. Both require explicit enabling and user authorization.

Should I factory reset my iPhone too? If your Apple ID was compromised, yes. The attacker may have enrolled your iPhone in MDM, installed profiles, or configured call forwarding. Erase all content and settings, then set up as new — not from backup — after changing your Apple ID password.