Signs Someone Is Watching Your Mac Screen (and How to Stop It)

Quick answer: Check System Settings > Privacy & Security > Screen & System Audio Recording for apps you don't recognize, and watch the menu-bar area for a purple or orange recording indicator. Then review Camera, Microphone, and Accessibility permissions, and use Activity Monitor and lsof -i to spot unfamiliar processes or outbound connections.

That feeling — the sense that someone might be seeing what's on your screen — is one of the most uncomfortable things about owning a computer. For most people it turns out to be nothing. But "probably nothing" isn't the same as "definitely nothing," and macOS gives you enough tools to actually check rather than just worry.

I've spent a lot of time inside macOS privacy internals while building CoreLock, and the honest answer is reassuring: on a modern Mac, it's genuinely hard for software to watch your screen without leaving a trace. Apple built the system to surface these things. You just have to know where to look.

> Run a free CoreLock Security Score to see every app with screen, mic, camera, or full-disk access in about 60 seconds — no account required.

The Recording Indicator Is Your First Clue

Start with the thing Apple designed specifically for this worry. When any app records your screen, macOS shows a small indicator in the menu bar near the Control Center icon. On recent versions of macOS it's a purple icon, and when you click Control Center you'll see exactly which app is doing the recording.

There's a similar system for your camera and microphone, using small colored dots:

• Orange dot near the top-right of your screen means your microphone is active.
• Green dot means your camera is on.
• A purple screen-recording icon appears in the menu bar when an app is capturing your display.

These indicators are OS-enforced, which is the important part. An app can't quietly turn off the green dot while using your camera. So if you ever glance up and see a dot you can't explain — no video call open, no screen recording you started — that's your signal to investigate. Click Control Center to see the culprit.

That said, don't over-read a brief flash. Lots of normal apps legitimately touch the mic or camera for a second (Siri, FaceTime ringing, a browser tab checking permissions). The thing to notice is a dot that stays on when nothing you opened should be using it.

Check Screen Recording Permissions Directly

The indicator tells you what's happening *right now*. To see what *could* happen, go to the source of truth.

Open System Settings > Privacy & Security > Screen & System Audio Recording. This is the master list of every app you've ever granted permission to capture your display. On older macOS versions this is labeled just "Screen Recording."

Read the whole list slowly. The real question isn't "do I recognize this app?" — it's "do I remember giving *this specific app* permission to see my screen, and does it have a reason to?"

Legitimate apps here include screenshot tools, video conferencing apps (Zoom, Teams, Google Meet), screen recorders like OBS, and remote-support tools. What doesn't make sense is a PDF reader, a "cleaner" utility, or a game asking to record your screen. When I was building CoreLock's scanner, the number of apps requesting permissions they have no business needing genuinely surprised me.

To revoke access, flip the toggle off next to the app. It stops being able to record immediately. The app might prompt you to re-grant it the next time it actually needs it — and if it's something legitimate like Zoom, that's fine. If it's something you don't recognize, leave it off and look into where it came from.

Don't Forget Remote Access Tools

"Watching your screen" doesn't always mean recording a video file. Sometimes it means someone is logged into your Mac remotely and seeing it live. This is one of the most common real scenarios, especially after a fake "tech support" call.

Check two places:

1. System Settings > General > Sharing. Look at Screen Sharing and Remote Management. If either is switched on and you didn't turn it on, that's a serious red flag — turn it off.
2. System Settings > Privacy & Security > Accessibility. Apps with Accessibility access can control your Mac, including your mouse and keyboard. Remote-control tools like TeamViewer, AnyDesk, or RustDesk live here. If you see one of these and never installed it, that's how someone could be watching and controlling your machine.

If you find a remote-access app you didn't install, revoke its permissions, quit it, and uninstall it. Then change your important passwords from a different device, since anyone with live access could have seen them.

Use Activity Monitor to See What's Actually Running

Permissions tell you what *can* happen. The running process list tells you what *is* happening. Open Activity Monitor (it's in Applications > Utilities, or just search Spotlight).

Click the CPU tab and sort by process name. You're looking for two things: processes you don't recognize, and processes using a surprising amount of CPU or energy when your Mac should be idle. A hidden screen-capture or streaming process often shows up as steady background CPU use even when you're not doing anything.

Double-click anything suspicious to see its full file path. Legitimate macOS processes live in places like /usr/bin, /usr/sbin, /System/, or inside proper .app bundles in /Applications. Something running out of /tmp, a hidden folder in your home directory, or a randomly-named location deserves a closer look. A quick search of the exact process name usually tells you whether it's normal.

Watch Network Activity for Streaming

Here's a detail people miss: if someone is watching your screen remotely or an app is streaming your display somewhere, it has to send that data over the network. You can catch that.

Open Terminal and run:

lsof -i | grep ESTABLISHED

This lists every active network connection along with the process that owns it. Most of what you see will be legitimate — your browser, Mail, sync services, system processes. What you're hunting for is an unfamiliar process holding an open connection, especially one you can't tie to anything you opened.

You can also list the busiest processes and cross-reference them with lsof:

ps aux | sort -nrk 3 | head -10

A process that's both eating CPU *and* maintaining a network connection, while doing nothing you asked for, is worth running down. None of this is proof on its own — plenty of normal software is chatty. The skill is in noticing the thing that doesn't fit your usual patterns, which is why getting familiar with what "normal" looks like on your Mac pays off. If you want to go deeper, our guide on hidden processes running on your Mac covers more Terminal techniques.

Other Honest Signs Worth Noticing

Beyond the technical checks, a few real-world signs are worth paying attention to — without spiraling into worrying about every one:

• The camera or mic indicator turns on when you're not using either. This is the strongest single sign, because it's enforced at the OS level.
• Your fan runs hard while the Mac sits idle. Continuous background recording or streaming uses real resources. It's not conclusive, but combined with an unexplained process, it's meaningful.
• Battery drains faster than it used to, for no clear reason. Same logic — something is doing work in the background.
• New apps or login items you don't remember installing. Check System Settings > General > Login Items & Extensions for things that launch automatically.

Any one of these alone usually has an innocent explanation — a browser tab, a macOS update indexing your drive, a backup running. It's the *combination* — an unexplained indicator plus an unknown process plus a permission you never granted — that turns a vague worry into something worth acting on.

How to Actually Shut It Down

If you've found something, here's the clean order of operations:

1. Revoke the permissions. In Privacy & Security, toggle off Screen Recording, Camera, Microphone, and Accessibility access for anything you don't trust. This cuts off the capability immediately.
2. Quit the process. In Activity Monitor, select it and click the stop button (the octagon with an ×), then Force Quit if needed.
3. Remove it from launching again. Check Login Items, and look at ~/Library/LaunchAgents, /Library/LaunchAgents, and /Library/LaunchDaemons for .plist files that relaunch the app on startup. Our keylogger detection guide covers inspecting these .plist files safely.
4. Uninstall the app properly. Dragging it to the Trash often leaves files behind. Check /Applications and ~/Library/Application Support.
5. Change your important passwords from a different device if you found genuine remote-access or recording software, and turn on two-factor authentication where you can.

When You Should Stop Worrying

I'll be straight with you, because non-alarmism matters here: the overwhelming majority of "is someone watching my screen?" worries end with a clean checklist and a clear conscience. Modern macOS makes silent, invisible screen-watching genuinely difficult. The indicator dots, the permission panels, and System Integrity Protection are all working in your favor.

If you've checked Screen Recording, Accessibility, and Sharing permissions, scanned Activity Monitor, glanced at your network connections, and everything looks like apps you actually installed — that's a real, earned "you're fine." You don't need to keep checking every hour. What's worth doing is making this a *habit* rather than a panic: every month or two, skim those permission lists so you know your baseline well enough to spot anything that doesn't belong.

If running through System Settings panel by panel feels like a lot, that's exactly the tedious part we automated. The CoreLock Security Score reads the same permission data you'd check manually — screen recording, camera, microphone, and full-disk access — and lays it out in one screen so you can see what every app can reach without digging through menus. It's free, and the point is simple: replace the vague unease with a clear answer.

If you'd rather verify it all by hand first, our walkthrough on checking which apps are recording you covers the camera and microphone side in the same plain-English detail.