Don't wait until your wallet is drained to check your computer: a 15-minute audit of Macbook permissions, backdoors, and suspicious processes

Author: Ash (@ahboyash, security researcher at Memento Research)

Compiled by: TechFlow

TechFlow Editor's Note:In the aftermath of the $6.3 billion Binance hack, the reality that attackers took control of an entire withdrawal signing system by compromising just one operations engineer's personal computer once again sounded an alarm for the whole industry. For every on-chain investor, your personal computer is not just a daily browsing tool; it is a core physical bastion holding wallet recovery phrases, private key authorizations, and asset operations. If it is breached by a trojan disguised as fake meeting software, a fake extension, or a malicious configuration file, any on-chain defense instantly drops to zero.

In response, Web3 security researcher Ash wrote this highly practical, lightweight self-check guide. It requires no obscure geek knowledge; in just 15 minutes, you can systematically check for screen monitoring, malicious device management profiles, backdoor login items, and abnormal mining processes by reviewing system settings and basic read-only commands. The entire process performs only information reading and does not change any computer settings.

The internet today is full of landmines, especially if you work in the crypto industry, because hacking attacks on crypto assets offer extremely lucrative returns. Take some time to perform a comprehensive audit of your Macbook. Every action listed below only reads system information and will never change your computer configuration.

A quick reminder: absolutely do not copy and paste any terminal commands given by strangers, including me. First send each command to your own AI assistant, understand its specific meaning and effect, and then run it with confidence.

System Settings Audit

Press Command (⌘) + Space to open System Settings on your Macbook.

• Check who can monitor your screen, files, and keyboard input: Go to Privacy & Security and check Accessibility, Screen Recording, Full Disk Access, and Input Monitoring one by one. Remove any applications you do not recognize or need. Infamous wallet-draining trojans and phishing malware disguised as video conferencing software typically request these dangerous permissions.

• Check for remote access backdoors: Go to General > Sharing. Make sure Screen Sharing and Remote Login are fully disabled.

• Check device profiles and mobile device management: Go to General > Device Management. On a personal, privately owned Macbook, this list should be completely empty. Some rogue malware can secretly install profiles here to control and monitor the entire computer.

• Check login items and background extensions: Go to General > Login Items & Extensions. Carefully review the Open at Login list and apps allowed to run in the background, and turn off any program you do not recognize.

• Check for malicious browser extensions: In the Chrome address bar, enterchrome://extensionsand press Enter. Review all installed extensions one by one, and remove any suspicious extension or any extension you did not install yourself.

• Check for unfamiliar applications: Open Finder, go to the Applications folder, sort by Date Added in descending order, and carefully check any unfamiliar apps that appeared recently.

Terminal Command-Line Audit

Terminal is a native macOS application that lets users communicate directly with the operating system's underlying layer through a text-based command-line interface (CLI).

How to open: Press Cmd + Space to open Spotlight Search, type Terminal, then press Enter. A small window with a text prompt will appear.

How to use: Copy one command at a time, paste it into Terminal using Cmd + V, press Enter to execute it, and observe the output on the screen.

Important reminder again: Do not blindly trust or paste Terminal commands provided by strangers (including me). First send the command to an AI assistant you trust, have it explain what the command does in plain language, and only then run it.

Check whether the device is being controlled externally

Run the following read-only diagnostic command in Terminal:

sw_vers -productVersion; profiles status -type enrollment

Assessment criteria:For a personally used Macbook, every line in the output that contains 'Enrolled' must clearly show the status as No.

Native security protection status check

Run the following read-only diagnostic commands in Terminal to quickly check the system core security mechanisms:

fdesetup status; /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate; spctl --status; csrutil status; softwareupdate -l

Assessment criteria:A normal expected output should show the following security status: FileVault (full-disk encryption) displays 'FileVault is On'; the Firewall displays 'Firewall is enabled'; application security assessments display 'assessments enabled'; System Integrity Protection displays 'System Integrity Protection status: enabled'; and there are no pending emergency security updates to install.

Check startup items and daemons

Malicious trojans often hide in startup daemon directories. Run the following command in Terminal to list all startup configuration files:

ls ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons

Assessment criteria:Startup configuration file names usually begin with the developer or vendor prefix (for example, com.google.xxx). If you see any unfamiliar or oddly spelled file names in the list, copy each one individually and verify its source and ownership using a search engine.

Check CPU usage and abnormal mining activity

Mining trojans that secretly consume computing power usually appear in the CPU usage list. Run the following command in Terminal to view the top 15 processes by current CPU usage:

ps -Ao %cpu,comm -r | head -15

Assessment criteria:Normally, the top entries are usually WindowServer (the system graphics rendering service), Chrome, and large applications you are actively running. If you see any unknown process at the top of the list with an unfamiliar name that is consuming excessive CPU resources, proceed with caution and investigate it in detail.

Although these checks cannot guarantee detection of every extremely hidden advanced persistent threat (APT), they are sufficient to block and remove most common opportunistic malware targeting crypto users.

Source: TechFlow