Watch mode

Watch mode is how Cloak Watch notices an attack while it’s happening, not just at the next scan. It follows changes to the files attacks write, such as launch agents, shell profiles and Python startup files, and once a minute it looks for programs running from places Mac stealers use. Both are on by default and run on your Mac only.

×

Turn it on or off

Both switches are in Settings › General:

Setting	Default	What it does
Watch for changes as they happen (under Scanning)	On	Checks a project within seconds of an install or a change to its settings. Off, Watch only scans once a day and when you ask.
Check running programs (under Watch mode)	On	“Once a minute, while Watch is watching for changes, it looks for programs running from places Mac stealers use: hidden files in your home folder, temp folders and paths from published incidents. It never reads what they do.” It’s greyed out while Watch for changes as they happen is off.

Under Check running programs, a line says what the last check found, for example Last check: 512 programs, nothing unusual. About 1 ms of CPU a minute., or Off.

Changes to files

With Watch for changes as they happen on, Watch follows file changes in your code folders and in the places attacks persist or leave files: launch agents and daemons, shell profiles, the folders that hold Python startup files, credential files such as ~/.ssh and ~/.aws, wallet apps in /Applications, and AI agent, editor and MCP configs. After a burst of changes settles, it rechecks only what changed. For example:

• a .pth file that pip install added is checked about a second after the install finishes;
• a known-bad npm version becomes a Fix now card in about a second;
• a wallet app replaced in /Applications is checked as soon as it lands.

Watching files costs nothing while nothing changes. See How Watch keeps checking.

Running programs

Once a minute, at low priority, Watch lists the programs running as you and looks for two things:

Card	Tier	When
PROC-1: “Running now: a program … uses”	Act now	A program runs from a path a published incident names, such as an AMOS stealer backdoor’s ~/.helper, XCSSET’s ~/.root, or ~/.n2 and ~/.n3 from the InvisibleFerret and BeaverTail malware. For scripting tools (python, node, bash, osascript, perl, ruby and others), Watch also checks whether the script they run is at one of those paths.
PROC-2: “Unsigned program running from …”	Review	An unsigned or ad-hoc-signed program runs straight from a temporary folder, or as a hidden file in your home folder.

When a file an incident names has its own card and is also running, that card says “It’s running now”. To stop the program, use Stop… in I think I’ve been hit.

For each program, Watch reads only its path, its user and start time, and its code signature, plus, for scripting tools, which script they run. It doesn’t record what programs do, and nothing about them leaves the Mac.

What it can miss

A program that starts and finishes between two checks isn’t seen. Watch mode is a second net, not a replacement for not running the bad install in the first place: a cooldown keeps most bad versions off.

What it costs

On a developer Mac with about 580 running programs, each check took about 1.6 ms of CPU in Subcloak’s tests. Run as Watch runs it, once a minute at low priority, ten minutes of checks used 53 ms of CPU in total.

Apple XProtect

macOS has its own malware rules and remover, XProtect, which Apple updates in the background. Watch shows its state; it doesn’t copy or use Apple’s rules.

• Settings › General › Watch mode › Apple XProtect shows the rules version and when they were installed, for example Rules 5368, updated 2 days ago, with · updates off when automatic updates are off.
• MAL-2 raises “macOS won’t install XProtect updates by itself” (Review) when Install Security Responses and system files is off in System Settings › General › Software Update › Automatic Updates, and “XProtect’s rules are N days old” (FYI) when they’re more than 60 days old.
• The Verify step of I think I’ve been hit also shows XProtect Remediator’s version and when it last ran.

Wallet apps

Crypto stealers swap wallet apps for look-alikes. Watch checks Ledger Live, Trezor Suite, Exodus, Electrum, Atomic Wallet, Coinomi, Guarda, Wasabi Wallet, Sparrow, Bitcoin Core, Keplr and Monero GUI in /Applications and ~/Applications, and raises MAL-1 at Act now when one isn’t signed by its developer, was changed after it was signed, or its developer changed since Watch first saw it. Watch reads only the app’s Info.plist and signature, never the wallet’s data.

The fix moves the app to Quarantine. Then reinstall it from the vendor, and from another device, move your funds to a new wallet: a swapped wallet app may have taken your recovery phrase.

From Terminal

• watchctl processes runs the running-programs check once and prints any hits.
• watchctl xprotect prints XProtect’s state.

Related

Respond to an incidentStop a program and clean up.

Detection cataloguePROC-1, PROC-2, MAL-1 and MAL-2.

SettingsSettings › General.