Mouse moving vertically up and down, as well as clicking, on its own

Security

While away from my desk, but the screen still visible, I noticed the mouse start to move. It went up to the current window's top bar, double clicked. This caused that window to minimize. Then it selected something on the next window (it was an Amazon window, it selected a particular shirt color). Then went to that window's top bar and double clicked. The next window was still a chrome window, but the content of the webpage wasn't interactable. On it, the mouse then zoomed in, dragged around a little, then went to the top of the screen and double clicked a running application's menu bar icon. Incidentally, this triggered a macOS dialog box to open asking me if I'd like to grant permission to the application to register all key events from all applications.

At this point I immediately stepped in and started moving the mouse around to prevent it from hitting accept. I think it's important to note here that the mouse wasn't moving like a person would move it, but jumping from point to point. Despite intervening, the mouse just kept exhibiting what seemed like programmed behavior. Then in an effort to prevent any more activity I locked the screen. To my surprise, the behavior continued, then after several minutes stopped on its own.

Not long after — perhaps 20 minutes — it started exhibiting what appeared to be the same pattern of motion (moving up, double clicking, moving to the center, clicking, etc.). This all happening on the lock screen.

I tried disconnecting my trackpad and even my keyboard, but it did not stop the behavior. Now, it has been some hours since it first started, it stopped a couple of times more, but now it seems perpetual (been going on for two hours now).

Is there any way for me to determine what could be causing the mouse to click and move without my input?

Best Answer

A couple of suggestions to get you going…

  1. Disconnect it from the network [not just the internet]. Reboot.

  2. Disable any Automator actions ~/Library/Automator [perhaps zip them, then delete, as there can be many in there for legitimate reasons]. Reboot.

  3. Repeat 2 with anything in ~/Library/Services & ~/Library/Scripts & also see if you have a folder in ~/Library/ called QuicKeys.

  4. Install & run Malwarebytes.

Report back…