Your MacBook may occasionally display security alert boxes on its screen, and most of them are usually fairly benign. But one that has the potential to raise your blood pressure is the rather ominous warning that “Your screen is being observed.”
So, why does it say that your screen is being observed on Mac? You may start to wonder, “Am I being watched by a hacker?” Is this a serious threat? Or is it a harmless issue that you can safely ignore by exiting the notification?
Why are you seeing the “Your screen is being observed” message on your Mac?
Before we delve into the possibility of malware, let’s first look at the non-threatening reasons why your Mac says “Your screen is being observed,” including on your lock screen.
Screen Sharing or Remote Management is enabled
The most common non-sinister reason why your MacBook is warning you about your screen being observed is that you enabled screen sharing yourself and forgot to turn it off. If this is the case, it’s easy to check and disable it.
Another possibility is that someone is remotely monitoring your Mac (for example, if you have a work device and your company IT department is monitoring your screen).
If you don’t have a Mac for work, then somebody else with direct physical access to the device could have turned it on. Again, this is easy to check.
AirPlay is on
The AirPlay feature on a Mac is used to mirror your Mac’s screen to another device, such as an external monitor or a smart TV. It’s as easy to do this as it is to forget that the setting is still turned on.
Screen recording is currently on
If you’ve been recording something on your screen using QuickTime or running a podcast with OBS Studio, your screen may still be recording. Check to see if you, or someone else, forgot to turn this off.
You’re using an Accessibility tool
Some Apple Accessibility tools require access to the Mac’s screen, such as screen readers. These are obviously legitimate tools. Nevertheless, it is not always possible to disable them if the Mac user needs them.
It’s malware
If it’s not something obvious, like AirPlay, Screen Sharing, or screen recording, unfortunately, the reason could be malware.
If malware has found its way onto your Mac, it could be using your device to secretly take screenshots, mirror your display to someone else, or record your activity. These threats will do their best to stay hidden, often disguising themselves as legit processes to go undetected.
This is where Moonlock is essential. It is built specifically for macOS and can scan every area of your computer looking for infections. It will uncover hidden apps, dormant files that may have been untouched for years — even mail attachments! Once it detects something suspicious, the threat is immediately quarantined and presented to you for review and deletion.
If you think there is something suspicious going on with your Mac, you can sign up for a free trial of Moonlock to run a Deep Scan. It will take a relatively short time and will give you the ultimate peace of mind that malicious actors haven’t found their way onto your machine.
Fix the “Your screen is being observed” warning on your Mac
Now, let’s go through removal tips for the “Your screen is being observed” message box based on what we’ve outlined above.
If you’ve been using one of the following settings recently, you’ll be able to immediately narrow down the cause of the message and fix it in less than a minute.
Disable Screen Sharing or Remote Management
To find out if your screen is being shared or if someone is remotely viewing your screen, do the following:
Go to System Settings > General > Sharing.
See if Screen Sharing or Remote Management are on. If so, toggle them off. If your computer is a work device and your employer insists on Remote Management being on, you may not be able to turn this setting off.
Check to see if AirPlay is running
Have you mirrored your MacBook screen lately? If the culprit isn’t Screen Sharing or Remote Management, it could be AirPlay.
Check your external monitors and smart TV to see if your screen is appearing there. Go to System Settings > General > AirDrop & Handoff.
In the AirDrop & Handoff settings, turn off AirPlay Receiver.
Is your screen recording?
Still haven’t found the cause yet? Let’s check the possibility that your screen is currently being recorded.
Check and (if necessary) shut down QuickTime, OBS Studio, VLC Player, Zoom, or any other VoIP apps like Google Meet.
You’re sure to remember if you used any of these recently. If you did, and you happened to be recording your screen, that would be the next thing to check.
Are you using any Accessibility tools?
There are 5 macOS Accessibility tools that may be tripping the “Your screen is being observed” alert.
If you use Accessibility tools, go to System Settings > Accessibility, and check the following:
- Zoom
- Switch Control
- Screen Curtain
- Accessibility Keyboard
- Invert Colors/Reduce Motion/Color Filters
If any of these options are enabled, disable them if you don’t need them. If you do need them, you’ll have to leave them enabled.
Check your Mac for malware infections
If you still haven’t uncovered the source of the problem, it’s time to look at the possibility that malware, such as a remote access trojan (RAT) or spyware, is to blame.
Here are some possible ways that malware could have gotten onto your device:
- Clicking an infected weblink or scanning a malicious QR code
- Opening an infected email attachment
- Downloading cracked software
- Browsing shady websites
- Clicking a pop-up ad
- Downloading fake system and app updates
- Jumping through an unpatched OS or app vulnerability (known or unknown)
To check if malware has gotten into your system, you first need to disconnect from Wi-Fi. This will cut off any connection that the malware has outside of the computer, so it can’t send any data or information. Once the Mac is offline, Moonlock can help with finding and removing any threats.
Moonlock goes far beyond traditional surface-level Mac protection. It runs Deep Scans to hunt down stealthy threats hiding deep in your macOS. Once they’re found, it will also walk you through removing them, setting up your security settings, and providing Real-Time Protection so you are protected moving forward.
Here’s how to check your Mac for malware that could be spying on you:
- Get started with the free trial of Moonlock.
- Find the Malware Scanner tab.
- Run a Deep Scan. This will scan absolutely everything on your Mac, including hidden and dormant files.
- Review the scan results. Anything the scan found will be kept in Quarantine. It can do no harm in there, so take your time to review the results.
- Click Remove to delete all suspicious files.
- Enable Real-Time Protection and Background Monitoring to keep your Mac protected from threats.
If you’re unsure whether your Mac’s “screen is being observed” alert is harmless or not, don’t wait. Try Moonlock free and find out for sure.
What to do if the “Your screen is being observed” message doesn’t go away
If, after all this, you still can’t get the message to go away, try the following:
- If an employer is remotely monitoring your work Mac, ask them to disable it, or ask how to disable the notification.
- Update macOS. It’s possible an older version of macOS is sending you false alerts.
- Restart the Mac. Sometimes, turning your computer off and on again works.
- Check Login Items at System Settings > General > Login Items & Extensions. See if anything there could be restarting the alert box.
- If all else fails, contact Apple Support for help. The persistence of the message could be a deeper system-wide issue.
Overall, never jump to conclusions. A lot of the time, the appearance of the “Your screen is being monitored” alert is harmless and can be narrowed down to one of the possibilities listed in this article. But other times, it can be a sign of malware and could be a clue that somebody is secretly watching you.
This is an independent publication, and it has not been authorized, sponsored, or otherwise approved by Apple Inc. Mac and macOS are trademarks of Apple Inc.
