Malware

Why your Mac says “Your screen is being observed” and how to stop it

Mark O'Neill

Jul 25, 20256 min read

Why your Mac says “Your screen is being observed” and how to stop it (Header image)

Your MacBook may occasionally display security alert boxes on its screen, and most of them are usually fairly benign. But one that has the potential to raise your blood pressure is the rather ominous warning that “Your screen is being observed.”

So, why does it say that your screen is being observed on Mac? You may start to wonder, “Am I being watched by a hacker?” Is this a serious threat? Or is it a harmless issue that you can safely ignore by exiting the notification?

Why are you seeing the “Your screen is being observed” message on your Mac?

A screenshot of the "Your screen is being deserved" notification on a Mac.
Mac and macOS are trademarks of Apple Inc.

Before we delve into the possibility of malware, let’s first look at the non-threatening reasons why your Mac says “Your screen is being observed,” including on your lock screen.

Screen Sharing or Remote Management is enabled

The most common non-sinister reason why your MacBook is warning you about your screen being observed is that you enabled screen sharing yourself and forgot to turn it off. If this is the case, it’s easy to check and disable it.

Another possibility is that someone is remotely monitoring your Mac (for example, if you have a work device and your company IT department is monitoring your screen).

If you don’t have a Mac for work, then somebody else with direct physical access to the device could have turned it on. Again, this is easy to check.

AirPlay is on

The AirPlay feature on a Mac is used to mirror your Mac’s screen to another device, such as an external monitor or a smart TV. It’s as easy to do this as it is to forget that the setting is still turned on.

Screen recording is currently on

If you’ve been recording something on your screen using QuickTime or running a podcast with OBS Studio, your screen may still be recording. Check to see if you, or someone else, forgot to turn this off.

You’re using an Accessibility tool

Some Apple Accessibility tools require access to the Mac’s screen, such as screen readers. These are obviously legitimate tools. Nevertheless, it is not always possible to disable them if the Mac user needs them.

It’s malware

If it isn’t any of the innocuous reasons listed above, malware could be to blame. This is a whole different ballgame and requires dedicated tools to fix.

Virtually all malware (with the exception of ransomware) can be removed with an anti-malware tool. We’ll recommend one below, so keep reading.

A screenshot showing the CleanMyMac Protection feature looking for threats.

Fix the “Your screen is being observed” warning on your Mac

Now, let’s go through removal tips for the “Your screen is being observed” message box based on what we’ve outlined above.

If you’ve been using one of the following settings recently, you’ll be able to immediately narrow down the cause of the message and fix it in less than a minute.

Disable Screen Sharing or Remote Management

To find out if your screen is being shared or if someone is remotely viewing your screen, do the following:

Go to System Settings > General > Sharing.

A screenshot of the General section of the macOS System Settings.
Mac and macOS are trademarks of Apple Inc.

See if Screen Sharing or Remote Management are on. If so, toggle them off. If your computer is a work device and your employer insists on Remote Management being on, you may not be able to turn this setting off.

A screenshot of the Sharing section of the macOS System Settings.
Mac and macOS are trademarks of Apple Inc.

Check to see if AirPlay is running

Have you mirrored your MacBook screen lately? If the culprit isn’t Screen Sharing or Remote Management, it could be AirPlay.

Check your external monitors and smart TV to see if your screen is appearing there. Go to System Settings > General > AirDrop & Handoff.

A screenshot showing the location of the AirPlay & Handoff sections in macOS System Settings.
Mac and macOS are trademarks of Apple Inc.

In the AirDrop & Handoff settings, turn off AirPlay Receiver.

A screenshot of the AirPlay section of the macOS System Settings.
AirPlay, Mac, and macOS are trademarks of Apple Inc.

Is your screen recording?

A screenshot of showing a QuickTime drop-down menu with the option for a "New Screen Recording."
QuickTime is a trademark of Apple Inc.

Still haven’t found the cause yet? Let’s check the possibility that your screen is currently being recorded.

Check and (if necessary) shut down QuickTime, OBS Studio, VLC Player, Zoom, or any other VoIP apps like Google Meet.

You’re sure to remember if you used any of these recently. If you did, and you happened to be recording your screen, that would be the next thing to check.

Are you using any Accessibility tools?

A screenshot of the Accessibility section of the macOS System Settings.
Mac and macOS are trademarks of Apple Inc.

There are 5 macOS Accessibility tools that may be tripping the “Your screen is being observed” alert.

If you use Accessibility tools, go to System Settings > Accessibility, and check the following:

  1. Zoom
  2. Switch Control
  3. Screen Curtain
  4. Accessibility Keyboard
  5. Invert Colors/Reduce Motion/Color Filters

If any of these options are enabled, disable them if you don’t need them. If you do need them, you’ll have to leave them enabled.

Check your Mac for malware infections

If you still haven’t uncovered the source of the problem, it’s time to look at the possibility that malware, such as a remote access trojan (RAT) or spyware, is to blame.

A screenshot showing an example of a QR code used in a tax scam.
The use of QR codes in tax-related scams is becoming increasingly popular among threat actors. Image: Screenshot, Moonlock.

Here are some possible ways that malware could have gotten onto your device:

  1. Clicking an infected weblink or scanning a malicious QR code
  2. Opening an infected email attachment
  3. Downloading cracked software
  4. Browsing shady websites
  5. Clicking a pop-up ad
  6. Downloading fake system and app updates
  7. Jumping through an unpatched OS or app vulnerability (known or unknown)

To check for malware, first disable your Wi-Fi connection to stop anything from leaving your device while you check. The next step is to use a powerful malware detection tool, such as CleanMyMac, powered by Moonlock Engine.

A screenshot showing the user interface for the CleanMyMac malware scanner.

CleanMyMac is a lightweight and efficient malware detection and elimination tool that will quickly find all threats on your MacBook. It will also scan for junk files that can also be connected to any malware it finds.

New customers get a free trial to give CleanMyMac a test run. Once you’ve signed up and installed CleanMyMac, follow these steps to fix your potential malware problem:

  1. In the left-hand sidebar of the main screen, click the icon third from the top (the raised hand). This is the malware detection function, labelled Protection.
  2. Click the Configure Scan button and select everything in the scan settings. Now, exit this window back to the main screen.
  3. Click the Scan button to start CleanMyMac’s thorough search through your MacBook, examining each file for any signs of an infection.
  4. If any infected files are found, CleanMyMac will round them up into a quarantined folder. Select them all and click Remove.
A screenshot of the CleanMyMac Protection feature showing threats that have been found.

What to do if the “Your screen is being observed” message doesn’t go away

If, after all this, you still can’t get the message to go away, try the following:

  1. If an employer is remotely monitoring your work Mac, ask them to disable it, or ask how to disable the notification.
  2. Update macOS. It’s possible an older version of macOS is sending you false alerts.
  3. Restart the Mac. Sometimes, turning your computer off and on again works.
  4. Check Login Items at System Settings > General > Login Items & Extensions. See if anything there could be restarting the alert box.
  5. If all else fails, contact Apple Support for help. The persistence of the message could be a deeper system-wide issue.

Overall, never jump to conclusions. A lot of the time, the appearance of the “Your screen is being monitored” alert is harmless and can be narrowed down to one of the possibilities listed in this article. But other times, it can be a sign of malware and could be a clue that somebody is secretly watching you.

This is an independent publication, and it has not been authorized, sponsored, or otherwise approved by Apple Inc. Mac and macOS are trademarks of Apple Inc.

MoonLock Banner
Mark O'Neill Mark O'Neill
Mark has been a technology writer since 2004 when he wrote a regular eBay column for AuctionBytes (now eCommerceBytes). He was a contributing writer to Lifehacker, Lifewire, PC World, and Android Authority, as well as a managing editor at MakeUseOf.