Every modern operating system lets an app ask to be told when a file is created, changed or deleted. Text editors, file managers, sync clients and antivirus products rely on it, and it needs no special privileges, only read access to the folder being watched. Researchers at Graz University of Technology in Austria have now shown that this ordinary feature, on Linux, Android, Windows and macOS, can be used to monitor other people on the same system, SecurityWeek reported.
No file contents, but a lot of behaviour
The attacks never read what is inside a file. What they collect is file names and the timing of events, and the researchers showed that this is enough to reconstruct what a user, an app or the system is doing. Most of the attacks assume the attacker can already run code on the machine under a separate account; on Android, it would be an app that asks for no permissions at all.
- On Linux, watching the folder around the device files that represent keyboard input revealed when a key was pressed, though not which one. Keystroke timing has been known for more than two decades to help infer what someone types. Input that shows nothing on screen, such as a hidden sudo password, was not captured.
- Also on Linux, the system fonts Firefox loads for a page were enough to identify which of the top 100 sites was being visited, and the team demonstrated a fake password prompt on KDE Plasma 6 (Wayland), drawn over the real one at the right moment.
- On Android phones (a Google Pixel and Samsung Galaxy models), an app with no permissions could watch another app’s private storage folder. Against WhatsApp, that revealed when photos, videos and documents were sent, received or deleted, along with their file names.
- On Windows, monitoring the root of the system drive reported the full path of every changed file on the machine, including inside other users’ home folders. Because Firefox stores data in folders named after websites, another user’s browsing could be followed in real time.
And the Mac?
macOS leaks the least, according to the research, because only files that are readable by everyone can be monitored there. Even so, the researchers could still track application launches, interactions with apps and changes to settings.
Patches and responses
The Linux kernel has been partly hardened so that device files no longer generate access and modify events, which the researchers say addresses the most severe issues (CVE-2025-68788). They list no fixes for Android or macOS. Microsoft told the researchers the Windows behaviour is by design; its spokesperson said the technique “requires an attacker to already have the ability to run code locally on a device under a separate user account and does not provide access to file contents.” Apple and Google had not responded to SecurityWeek. The researchers say they are not aware of anyone using this in the wild, and proof-of-concept code has been published on GitHub.
What this means for you
Two lessons carry over to any Mac. First, the precondition matters: almost every scenario starts with someone else’s code already running on your computer. The strongest defence is still the boring one: install only software you trust, keep macOS up to date, and give each person who uses the Mac their own account.
Second, spying is only half the job. Information gathered on your Mac is only useful to someone else once it leaves it. That is the part a firewall can see. FireAI asks the first time any app tries to reach the internet and remembers your answer, shows every destination on the world map, and lets you block an app outright. A little utility you installed last week that suddenly wants to talk to a server abroad is exactly the kind of connection it puts in front of you.
Download FireAI and try it free for 17 days. FireAI is made by HisnLabs.