Don't Wait Until Your Wallet Is Stolen to Check Your Computer: 15 Minutes to Investigate MacBook Permissions, Backdoors, and Suspicious Processes
Author: Ash (@ahboyash, Security Researcher at Memento Research)
Compiled by: TechFlow
Brief: In the wake of the $6.3 billion hack on Binance, the reality that attackers could compromise an entire withdrawal signing system merely by taking control of a single DevOps engineer's personal computer has once again sounded the alarm across the industry. For every on-chain investor, your personal computer is not just a daily browsing tool; it is the core physical fortress safeguarding wallet mnemonics, private key authorizations, and asset operations. Once breached by trojans disguised as fake meeting software, fraudulent plugins, or malicious configuration profiles, any on-chain defense will instantly drop to zero.
In response, Web3 security researcher Ash authored this highly practical, lightweight self-audit guide. No advanced technical expertise is required: simply spending 15 minutes cross-referencing system settings and basic read-only commands allows you to systematically scan for screen monitoring, malicious device management configurations, backdoor startup items, and abnormal mining processes. The entire procedure only executes pure information reads and does not modify any of your computer's settings.
The modern internet is riddled with traps, which is especially true for professionals in the cryptocurrency sector given the highly lucrative returns from crypto-related hacks. Take some time to run a comprehensive audit on your MacBook. Every operation listed below involves solely reading system information and will absolutely not alter your computer's configuration.
A quick reminder: Never directly copy and paste any terminal commands provided by strangers (including me)! Send each command to your own AI assistant first to understand its specific purpose and function before executing it with confidence.
System Settings Check
Press the shortcut Command (⌘) + Space to open your MacBook's System Settings.
• Check who can monitor your screen, files, and keyboard input: Navigate to Privacy & Security and review Accessibility, Screen Recording, Full Disk Access, and Input Monitoring item by item. Promptly remove any applications you do not recognize or do not need. Infamous wallet-draining trojans and phishing malware disguised as "video conferencing software" frequently trick users into granting these dangerous permissions.
• Check for remote access backdoors: Navigate to General > Sharing. Ensure both Screen Sharing and Remote Login are completely disabled.
• Check for device descriptor profiles and mobile device management: Navigate to General > Device Management. On a personal, privately owned MacBook, this list should be completely empty. Certain rogue malware secretly installs descriptor profiles here to covertly control and monitor the entire machine.
• Check login startup items and background extensions: Navigate to General > Login Items & Extensions. Carefully review the Open at Login list and apps listed under Allow in the Background, disabling anything you do not recognize.
• Check for malicious browser extensions: Enter chrome://extensions in the Chrome address bar and press Enter. Review all installed plugins individually and firmly uninstall any suspicious or unactively installed extensions.
• Check for unfamiliar applications: Open Finder, navigate to the Applications folder, sort by Date Added in descending order, and carefully inspect any recently appearing unknown apps.
Terminal Command Line Check
Terminal is the native application built into macOS that allows users to communicate directly with the operating system's core via a text-based command-line interface (CLI).
How to open: Press Cmd + Space to launch Spotlight search, type Terminal, and press Enter. A small window containing a text prompt will appear.
How to use: Copy one line of command at a time, paste it into the terminal using Cmd + V, press Enter to execute, and observe the output on the screen.
Stern reiteration: Do not blindly trust and paste terminal commands provided by strangers (even if they are from me). Always forward the command to your trusted AI assistant first, allow it to explain the command's specific function in plain terms, and only then proceed with execution.
Check if Device is Externally Controlled
Run the following read-only diagnostic command in the terminal:
sw_vers -productVersion; profiles status -type enrollment
Diagnostic Criteria: For a personal-use MacBook, every line containing "Enrolled" in the output must explicitly display a status of No.
Native Security Protection Status Check
Run the following read-only diagnostic command in the terminal to quickly verify core system security mechanisms:
fdesetup status; /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate; spctl --status; csrutil status; softwareupdate -l
Diagnostic Criteria: An ideal, healthy output should reflect the following secure state: FileVault displays as FileVault is On; Firewall displays as Firewall is enabled; Application security assessment displays as assessments enabled; System Integrity Protection displays as System Integrity Protection status: enabled; and there are no pending emergency security patches waiting to be installed.
Check Startup Daemons
Malicious trojans prefer to lurk hidden within the startup daemon directories. Execute the following command in the terminal to list all startup configuration files:
ls ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons
Diagnostic Criteria: Startup configuration files are typically named beginning with their developer's vendor prefix (e.g., com.google.xxx). If you encounter any filenames you completely do not recognize or find strangely formatted in the list, please copy them individually and verify their origin and ownership via a search engine.
CPU Usage and Abnormal Mining Check
Covert computing-power-consumption mining trojans usually reveal themselves on the CPU resource usage leaderboard. Run the following command in the terminal to view the current top 15 most CPU-intensive processes:
ps -Ao %cpu,comm -r | head -15
Diagnostic Criteria: Under normal conditions, the top positions are typically occupied by WindowServer (system graphics rendering service), the Chrome browser, and large applications you are actively running. If you spot any unfamiliar names at the top of the list that are frantically devouring CPU resources, remain vigilant and conduct a deeper investigation.
While the above checks cannot capture 100% of all highly stealthy Advanced Persistent Threats (APTs), they are fully sufficient to block and eradicate the vast majority of common opportunistic malware targeting cryptocurrency users.