Someone hacked my Macbook and starting applications?

[Nino88]

Hi,

First time in my entire life I am 90% sure someone is controlling my Macbook.

I have noticed this tonight while watching a movie in fullscreen while checking my phone.

Out of nowhere my screen swipes to the left and there it is, application SSH terminal has been started.

I have disconnected my WiFi instantly.

I am not crazy, but this is freaky.

What can I do? Do I have to reinstall my Macbook entirely?

Thanks in advance.

 

[casperes1996]

When you say "SSH Terminal has been started", what led you to believe this was an SSH connection? Usually that would be silent and not open a Terminal window.

Go to System Preferences->Sharing and report if any of the sharing options are turned on; Turn off as desired

 

[Nino88]

When you say "SSH Terminal has been started", what led you to believe this was an SSH connection? Usually that would be silent and not open a Terminal window.

Go to System Preferences->Sharing and report if any of the sharing options are turned on; Turn off as desired

I have noticed this for the first time ever. Not touching my trackpad at all watching a movie in fullscreen out of nowhere screen swipes to the left and application Termius SSH terminal has been started.

Last day I noticed that my mouse was moving for a half of a second. I thought that I am going crazy.

 

[richmlow]

Hi,

First time in my entire life I am 90% sure someone is controlling my Macbook.

I have noticed this tonight while watching a movie in fullscreen while checking my phone.

Out of nowhere my screen swipes to the left and there it is, application SSH terminal has been started.

I have disconnected my WiFi instantly.

I am not crazy, but this is freaky.

What can I do? Do I have to reinstall my Macbook entirely?

Thanks in advance.

Hello Nino88,


Wow, that is pretty freaky!

I think to be absolutely safe, do the following:

1. Keep your computer disconnected from the Internet.

2. Back up your valuable data on an external drive.

3. Completely reformat and clean install your MacOS.

4. Reinstall your applications and data.

5. Set security options to: No file sharing, no screen sharing, remote desktop option OFF.

6. Activate firewall.

Good luck.


richmlow

 

[HDFan]

application Termius SSH terminal

Termius is an application on your Mac, or are you talking about the built in terminal application? If the former, do you have any need for it? If not remove it with something like appcleaner, or the apps' installer.

 

[casperes1996]

Termius is an application on your Mac, or are you talking about the built in terminal application? If the former, do you have any need for it? If not remove it with something like appcleaner, or the apps' installer.

Termius is an app and is a rather nice program, though on macOS I would just use the regular Terminal; But it's great on iOS.
I wouldn't blame Termius for the behaviour, but if it isn't needed, sure, delete it

 

[Big Bad D]

Try running Malwarebytes?

 

[Apple_Robert]

The OP never did answer @casperes1996 question about which sharing options are on (if any) in system preferences. I think it is important to find that out before advising someone wipe their Mac and reinstall the OS.

What OS is the OP running?

When was this behavior first noticed?

Have any programs been installed recently? If so, were any of them downloaded outside the App Store?

Does the OP use any accounts on the Mac besides he Admin account?

Does anyone else have access to the Mac?

 

[IowaLynn]

Some things are weirder than they seem.

Apple Just Patched a Modem Bug That's Been in Macs Since 1999

A researcher found the 20-year-old flaw by drawing on tricks from a childhood spent tinkering with his parents’ Mac Performa.

www.wired.com

 

[iluvmacs99]

Hi,

First time in my entire life I am 90% sure someone is controlling my Macbook.

I have noticed this tonight while watching a movie in fullscreen while checking my phone.

Out of nowhere my screen swipes to the left and there it is, application SSH terminal has been started.

I have disconnected my WiFi instantly.

I am not crazy, but this is freaky.

What can I do? Do I have to reinstall my Macbook entirely?

Thanks in advance.

Don't freak out just yet. Is your Macbook Pro running Mojave and up? Is your phone an iPhone running iOS 14? If you answered yes to both and both are signed up to the same iCould account, then you are experiencing a feature called Handoff. You may inadvertently, what may look like, controlling your Mac via your iPhone if you are checking on your phone. It's a very handy feature which I use a lot, but can freak you out if you didn't know that there is this feature.

Hand off tasks between iPhone and your Mac - Apple Support

If it's not a handoff feature, HOWEVER, then it might sound like you may be a victim of ThiefQuest or EvilQuest, which is a ransom ware which installs a keylogger and a reverse shell (which I suspect was what may happen) to take full control of your Mac. Possible initial infection of this via pirated software or from visiting sketchy sites.

New ThiefQuest ransomware discovered targeting macOS users | ZDNet