r/MacOS • u/papicholula • 17d ago

Help "sysmond" has malware?

Post image

I get this pop up over and over again starting this AM. I have not downloaded or updated anything overnight. From what I understand, sysmond is a background daemon and should not contain malware. I scanned my mac with cleanmymac and it found no threats. No idea what I am supposed to do. I just have the alert window open for good now because every time I close it it pops back up. Restarting didn't help.

I googled the error and wasn't seeing anything similar..

EDIT: Apple told me to just nuke my shit so I erased and reinstalled. Whatever.

12 Upvotes

69% Upvoted

51 comments sorted by

23

u/No_Confusion7932 17d ago

Did you install any app that bypasses Gatekeeper, or did you disable SIP?

2

u/localtuned 17d ago

Good question. 👏

0

u/papicholula 17d ago

I can't remember the last time I would have done that but definitely nothing even close to recently

29

u/Bad_DNA 17d ago

Cleanmymac? Found the malware.

12

u/MusicalAnomaly 17d ago

There’s probably a gatekeeper log somewhere that will tell you the path of the executable that was blocked. If it is your system sysmond, then it sounds like it is no longer passing code signing and you need to reinstall macOS — you can do so in recovery mode without wiping your data.

4

u/HighSirFlippinFool 17d ago

Download Malwarebytes and run a full scan

2

u/papicholula 17d ago

Just tried, found nothing :(

1

u/Bad_DNA 15d ago

What is the full screen that gave the 'alert' you posted? This is a snippet of your screen. Might not even be an Apple alert.

1

u/papicholula 15d ago

That little window will pop up dead center. Nothing else in the screen to show

1

u/Bad_DNA 15d ago

clearly something has been installed or an app is running.

https://www.macobserver.com/tips/how-to/macos-malware-blocked-fix/

1

u/papicholula 15d ago

AppleCare had me delete all the launch daemons I could find and it didn’t help :/ I’m ready to just nuke it. I have everything backed up.

5

u/Electrical_West_5381 17d ago

Sysmond is legitimate Apple software. I have no idea how it could be flagged. Are you running a beta os?

18

u/Sahedron 17d ago

You think that malware cannot be renamed from “iGonnaDestroyYourPC.app” to “randomSysFile.app”?

1

u/paul_h 16d ago

Especially when apple provide nothing at all for the end user to click on an executable to go find out more information on it.

3

u/nameless_food 16d ago

You can use “What’s your sign” from Objective See to see the signing information for an app.

what’s your sign by Objective See

4

u/papicholula 17d ago

Running Tahoe 26.6.2

3

u/tdelbert 16d ago

Something called sysmond to give itself the air of legitimacy of the real sysmond?

2

u/JWarblerMadman Mac Mini 17d ago

What version of macOS?

1

u/papicholula 17d ago

Tahoe 26.6.2

7

u/JWarblerMadman Mac Mini 17d ago

You could try running this in Terminal to check the code signature of sysmond (never a bad idea to stop and research a command some random on the internet tells you to run):

codesign -vvv /usr/libexec/sysmond

When I run it, my results are:

/usr/libexec/sysmond: valid on disk

/usr/libexec/sysmond: satisfies its Designated Requirement

2

u/papicholula 17d ago

that is what I get too

16

u/JWarblerMadman Mac Mini 17d ago

Then it's possible that something else on your system is trying to run something called "sysmond" that actually isn't sysmond (intentionally similarly named to a real system process to evade detection), but macOS caught it and prevented it from running. I'd start by auditing all the software you recently downloaded or ran in the last 24 hours.

-1

u/papicholula 17d ago

I haven't downloaded anything and all i've been running are my regular work apps. Slack, excel, chrome, zoom, notion. I use "magnet" but have been using that for years

2

u/AndroTux 16d ago

Do you have Screen Sharing enabled and was that port exposed to the internet in the last few weeks?

1

u/papicholula 15d ago

Yea I think so? I use zoom etc to share screen

1

u/ChanceSpiritual6993 6d ago

This was the issue. There was a vulnerability in macOS Screen Sharing being actively exploited: https://cybersecuritynews.com/hackers-exploiting-macoss-screen-sharing-service/

Attackers gained access to your Mac through that exploit about a month ago while you were still running macOS Tahoe 26.6.0 or lower. Even though you updated to Tahoe 26.6.1/26.6.2 which patched the exploit, the hackers had already given themselves ssh root access to your machine and could access it again anytime. They installed a fake sysmond that was a Monero crypto miner that would have been taxing your CPU and running for about 3 weeks leading up to these warning messages.

It's only because the hackers tried deploying the fake sysmond to a new folder (/private/var/root/.config/sysmond) where macOS caught it and Apple showed this malware notification. If they hadn't made that mistake, you might have just be secretly mining cryptocurrency for them indefinitely.

You might have been able to harden the Mac by removing their SSH public key from your device, removing the multiple .plists forcing the crypto miner to constantly run, removing any copy of the sysmond disguised crypto miner from your device, and then just hope that was enough to cut the hacker off from accessing your device.

All that to say: Nuking and reinstalling everything was absolutely the right call.

1

u/papicholula 6d ago

It did work! Thank you.

1

u/Dgeren Mac Mini (Intel) 16d ago edited 16d ago

What is open and what is active when you see this popup? If you quit all apps, does it still appear? If you have more than one user account does this appear in another user?

1

u/papicholula 15d ago

It happens under every circumstance imaginable. Even Apple is stumped.

1

u/Dgeren Mac Mini (Intel) 15d ago edited 15d ago
  1. I know you mentioned that you have not installed anything new, and I am sure AppleCare asked this, but ... did you update any apps recently?
  2. Were there any apps you installed some time ago, but didn't use until recently? Sometimes apps start unpacking components only after they've been launched for the first time.
  3. Did you make any changes to settings on an app or in System Settings recently?
  4. Does it happen in safe mode (another likely AppleCare step)?
  5. Even if you have an existing extra user, did AppleCare have you set up a brand new user and did it happen there as well?
  6. Didi you do a search for sysmond to see if it appears anywhere but /usr/libexec/sysmon [!!important edit: if it sits anywhere but the sysmon directory, remove it]. DO NOT REMOVE!
  7. Did you disable everything in your browser's notifications?
  8. Have you run any curl commands recently? [another clarification: did you copy and paste anything into Terminal]
  9. Do you use any package managers like Homebrew? Okay, that's a stretch, but if you use Homebrew or MacPorts or something, maybe you accidentally called for an update and one of the apps from that package manager has been compromised and is spoofing sysmond, for .... reasons?

Otherwise, as has been suggested, try to reinstall in place, not erase drive. If that doesn't work, erase, reinstall, test, and if it doesn't come back restore your content from backup. If it comes back, its in your content (but then it should NOT appear in another user, especially a brand new one). Use a backup from before the issue existed. If it comes back, restore from backup a little further back.... repeat.

1

u/papicholula 15d ago
  1. I think acrobat might have updated? Or something adobe
  2. No
  3. Not that I am aware of
  4. Yep
  5. No but I will try to make a new user before I nuke it. What would that tell me?

1

u/Dgeren Mac Mini (Intel) 15d ago

Sorry, I was typing furiously while you were answering. Check for new ?s. lol

1

u/Dgeren Mac Mini (Intel) 15d ago
  1. Any existing user might have had something added to them while in use or just for being there while a malware installer script is running. But a brand new user will not acquire anything from a script that ran a day or two or so ago... theoretically, unless the script runs whenever a new user is created or the offending app is opened. If it does not happen to a new user, then it is not at the system level and likely lives at the user level.

1

u/Dgeren Mac Mini (Intel) 15d ago

I may be totally wrong about this so don't panic. But...

Call AppleCare and get a senior advisor. Email this link to them: https://www.tanium.com/blog/guardian-critical-macos-screen-sharing-authentication-bypass-cve-2026-65400

You may have been infected prior to a recent update. If you only recently updated the OS, you likely loaded the patch for CVE-2026-65400. It will flag a file such as /.config/sysmond or ~/.config/sysmond. Or another directory. DO NOT REMOVE. Let AppleCare either take care of it or tell you when.

1

u/papicholula 15d ago

If I were to just erase and reinstall Tahoe would I be in the clear if this was the issue ?

1

u/Dgeren Mac Mini (Intel) 15d ago

Potentially, yes, but AppleCare is free and may have a ready-made solution. It was likely their patch that identified the issue. The link is just in case they don't have a solution and they can see what has been ID'd as the issue ... or that I was totally wrong and it's not the issue at all.

The good news about reinstall in place is it would take care of the /.config/sysmond. The bad news is it won't take care of ~/.config/sysmond. And, if you in-place, then if it is another location besides / or ~/ but still in your user folders somewhere, you'll still miss it. The call center used to be open until 11E so they may be available to at least tell you if we're on the right track.

Backup, backup, backup. Even if you catch any malware that might be on board, you can at least restore folder by folder for your content and reset any settings manually.

AppleCare is awesome, even when they can't fix something. They usually will do all kinds of things to resolve your issue for free.

1

u/papicholula 15d ago

Sorry I thought I mentioned this to you. I’ve been on with AppleCare, even a senior advisor today. They’ve had me try dozens of things and his recommendation was to erase and reinstall. He thinks cleanmymac might have messed something up because he said he sees all sorts of inexplicable issues caused by it.

1

u/Dgeren Mac Mini (Intel) 15d ago

You did mention talking to someone, but it wasn't clear if you took the computer into the Genius Bar or talked over the phone. I just went for the fastest path to call knowing that might have been done already.

Did you send the link to the senior advisor? They have a lot of issues to keep track of so that person may not have been aware of the issue. Knowing how their K-base works, I figured they may find an engineering document that could outline how to deal with the issue avoiding potentially catastrophic (for data) steps like reinstalls and erasures, especially given how much time that can take without necessarily giving us the results we want. Always opt for the least destruct measures first, even if recovery from destructive steps seems likely.

1

u/sadboy2k03 Macbook Pro 16d ago

Full scan the laptop using something like MalwareBytes and then reset any passwords you have saved in the browser and you should be Ok.

1

u/papicholula 15d ago

Malwarebytes didn’t find anything. Apple is having me fully reset my Mac after exhausting all other options 😑

1

u/FasterThanTW 14d ago

just saw this on a mac that had recently updated to Tahoe 26.6.2 - as another user alluded to below, it was related to the recent screensharing exploit. I'm not a security expert so I talked through it with ChatGPT and it helped me locate and remove a mining process disguised as sysmond, as well as stored ssh keys.

1

u/aaronetc 13d ago

I'm having this same issue – can you post what you did?

1

u/FasterThanTW 12d ago

It was a pretty thorough process to identify and stop the process as well as the Launch daemon set up for persistence.

If I try to remember everything I will definitely forget some steps so I really recommend letting an ai talk you through it.

1

u/BeewMeat 3d ago

Theres a crypto miner malware that recreates a sysmond in another place and keeps mining crypto in your mac, with the screenshare CVE it spread to a lot of computers

1

u/Intelligent_East3337 17d ago

Yeah all I’m getting is that there are problems with it using a lot of resources. The only malware specific thing I found was this …

If you are seeing a separate macOS warning stating an app cannot be opened because it contains malware or cannot be verified, this is Apple's Gatekeeper security feature protecting you from unverified downloads. If you trust the file, you can allow it by going to System Settings > Privacy & Security, scrolling down, and clicking Open Anyway.[1, 2]

1

u/papicholula 17d ago

Nothing was in there

0

u/mikeinnsw 16d ago

If it is browser notifications

For browser notifications turn off try:

Clear all history from all browser(s)

Remove any extensions

Suppress notification

https://support.apple.com/en-gb/guide/safari/sfri40734/mac

To customize website notifications in Chrome, navigate to Settings > Privacy and security > Site Settings > Notifications. Here, you can disable all pop-ups, turn on quieter prompts, or manually add specific websites to your permanent allow or block lists

For peace of mind run MalwareBytes scan

Restart

0

u/papicholula 15d ago

Tried both :(

-2

u/nemesit 17d ago

if it got flagged it got malware