About 3 months ago, my windows often suddenly closed and the cursor would move. So I deleted all the team viewer apps and closed all the Share options in System Preference. I checked within Activity Monitor and also used netstat -n in terminal, but I don't know how to use/understand it.

How can I know if my Mac was being remotely viewed?

  • What's your theory about being watched? Spyware, native Remote Desktop, custom collaboration app, compromised system? Trying to base it on ports or specific remote ip seems odd. Why not check for screen sharing process / settings?
    – bmike
    Mar 22, 2017 at 11:30
  • Sorry, I rewrote the question description. Thank you for your reminding.
    – Knnop
    Mar 22, 2017 at 12:56

1 Answer 1


I would actually use the "last" command.

$ last > ~/Desktop/last_users.txt

will output the results to a document on the desktop you can open up and have a look at. Really, you should see your own user, reboot (a pseudo-user that gets activated when rebooting the computer), and just about nothing else. I. personally have a "_mbsetupuser" that has to do with updating my OS, so you may have that as well.

If you see any usernames you don't recognize, that's a red flag. If you see your own user on a tty other than "console" that might be an issue. I'm not really great with netstat nor lsof, but here's an lsof primer. The reason to learn lsof (whether in conjunction with netstat or not) is that linux treats most things as files. lsof (short for "list open files") is a utility that helps you find out which files are open. If someone's watching your system, they're opening "files" to do it, and that utility will show you that, unless there's a rootkit in place and/or the lsof utility itself has been hacked/modified to not show their presence, which is unlikely.

See a primer I quite like here: https://danielmiessler.com/study/lsof/


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .