How to determine if my mac computer has been hacked

Getty Premium images

A hacker can gain unauthorised access to your computer's resources using a variety of tricks. For example, he might guess or use brute force techniques to discover a legitimate user's password. Hackers may also exploit bugs or other security vulnerabilities in some software applications.

Regardless of the method used to gain entry, a hacker needs to use an account on the computer. You can determine if your Mac has been hacked by looking for computer accounts that you have not created and by checking to see if any of the legitimate accounts have been accessed in an improper manner.

Log in to your Mac OS computer using your regular user account.

Click "Applications" and then "Utilities."

Double-click on "Terminal." A new window will open and a prompt for text-mode commands will be displayed.

Type the following command into the Terminal window:

sudo -l

Press "Enter." Type your password and press "Enter" again.

List all accounts that exist on your Mac by typing the following command into the Terminal window:

dscl . list /users

Press "Enter." Mac OS X will list all existing accounts on the computer.

Discover whether an account has been created without your permission by inspecting and verifying that all accounts in the output from the above step are legitimate user accounts that you created. If you see any additional accounts, it's likely they were created by a hacker.

Check if an account has been misused by typing the following command into the Terminal window:


Press "Enter." The time and date of the last login to all each existing account will be displayed. If a recent login to any of the accounts occurred at an abnormal time, it probably was done by a hacker masquerading as a legitimate user.