While I Was at the Office, Someone Activated Screen Sharing on My Mac

For a few weeks, something felt off. Small things, impossible to name precisely. My MacBook open in the morning on a window I hadn't left open the night before. A Spotify session playing when I'd turned off the music before sleeping. My iPhone showing that someone had checked my location — but no one I'd shared it with that evening.

Not enough to confront anyone. Not enough to bring up without sounding paranoid. But more than enough to keep me from sleeping properly.

The person I suspected had accessed my Mac a few weeks earlier — "just to print something," they said. Ten minutes. Maybe less. And nothing felt the same after that.

Why I Installed Maclaw

On a Sunday evening, I searched for a macOS monitoring app. I wanted one simple thing: a record of what was happening on my machine when I wasn't there. Not a spying tool — a truth tool. For me.

I found Maclaw. The app continuously monitors camera access, microphone use, location requests, screen sharing activity, and system scripts. Everything is logged locally on the Mac. Alerts are delivered via Telegram, directly to my phone, in real time.

Setup: about ten minutes. No developer skills needed, no technical knowledge required. I just needed it to work. So I set it up and waited.

Monday Morning. 9:12 AM.

The next morning I was at the office by 9. Coffee in hand. Opening emails. My phone sitting on the desk buzzed.

Then again, two minutes later. Then again. Then a fourth time.

Four alerts in ten minutes.

I hadn't moved from my desk. My Mac was in my apartment, ten kilometers away. And someone was using it.

What These Four Alerts Actually Mean

If you don't know macOS deeply, here's what each event represents in practice:

Screen Sharing activated — someone enabled the feature that lets you view a Mac's screen in real time from another device. With that access, you see everything happening on the machine: open files, active conversations, running apps. As if you were sitting in front of the keyboard.

Camera accessed via FaceTime — the MacBook's front camera turned on. The little green dot lit up in my empty apartment. At 9:14 in the morning, on a Monday, while I was at the office.

Find My: location requested — someone requested my real-time location via Apple's Find My network. From my own Mac. To know exactly where I was at that moment.

osascript executed — this is the most technical alert, and the most telling. osascript is macOS's built-in scripting tool that allows automated actions to be run on the system. Regular users don't manually invoke osascript on a Monday morning. When it fires like this, a command was sent remotely to perform an action — open an app, copy a file, send a message. The possibilities are nearly unlimited.

What Maclaw Knows — and What It Doesn't

I want to be honest about what the app gave me. Maclaw monitors system events: it records what happened and when. It cannot identify who was at the keyboard or which account triggered these actions specifically.

In my case, the "who" didn't require a technological answer. My apartment was locked. Only one person besides me had had physical access to my machine in recent weeks. Maclaw's data wasn't legal evidence. But it was my truth.

Sometimes knowing is enough. Even without formal proof, knowing changes everything you do next.

Steps to Take If You're in the Same Situation

If you find yourself in a similar position, here's the recommended order of action. The absolute priority: secure your machine before doing or saying anything else.

1. Change your Mac password immediately
Apple menu → System Settings → Touch ID & Password → Change Password. Choose something unique that you haven't used anywhere else.

2. Disable Screen Sharing
System Settings → General → Sharing → disable "Screen Sharing" and "Remote Management." If you don't use these features daily, there's no reason for them to be active.

3. Audit user accounts on your Mac
System Settings → Users & Groups. If there's an account you don't recognize, delete it immediately. An unauthorized admin account grants full remote access to your machine.

4. Revoke camera and location permissions
System Settings → Privacy & Security → Camera / Location Services. Remove any apps you didn't install yourself or don't recognize.

5. Document everything before acting
Take screenshots of all Maclaw alerts. These are timestamped logs. Depending on your personal or professional situation, they may serve as important documentation.

What This Experience Really Taught Me

People underestimate how thoroughly a Mac can be compromised with just a few minutes of physical access. Install a background app. Enable screen sharing in preferences. Add an admin user account. Modify location permissions. All of it can be done silently, in under five minutes, with no visible trace.

Maclaw doesn't protect against that initial access — no software can if someone physically has your machine. But it makes the invisible visible. And once you know, you can act.

Monitoring what happens on your own machine isn't paranoia. It's simply acknowledging that your Mac contains your work life, your personal documents, your photos, your conversations, your real-time location — and that all of it deserves to be protected.

Your Mac is your private space. Nobody has the right to access it without your permission. And you have every right to know if someone does.

Now I know. And now you know it's possible.