Researchers from Graz University of Technology in Austria have shown that file change notification capabilities built into Linux, Android, Windows, and macOS can be leveraged to monitor other users on the same system, tracking everything from their typing rate to the websites they visit.
See also: LockBit 5.0 attacks Windows, Linux & ESXI systems
These operating systems allow applications to be notified when files are created, modified, or deleted. Programs such as word processors, file managers, synchronization clients, and antivirus products use this feature, which requires only read permissions to the monitored location and not elevated privileges.
Although the attacks do not reveal the contents of the files, the researchers have shown that the file names and timing of the events are sufficient to reconstruct user, application, and system activity. Most attacks require an adversary who can already execute code on the machine under a separate account. On Android, this could be an application that does not request permissions.
In Linux, a user who has been denied permission to watch a protected file can still receive its events by watching the folder containing it, as long as that folder is readable. This can be applied to device files that represent keyboard input, revealing when a user presses a key, but not which key.
Research spanning over two decades suggests that the spaces between keystrokes can help infer what is being typed. In tests with seven typists, the attack reliably detected keystrokes, achieving accuracy scores between 93.1% and 100%. Input that does not produce text on the screen, such as a hidden sudo password, is not recorded.
Other attacks on Linux include identifying websites based on the system fonts that Firefox loads for a page, identifying websites from the top 100 with 87.9% accuracy. The researchers also demonstrated a fake password prompt attack on the KDE Plasma 6 desktop running on Wayland, where a malicious process detects when the real authentication prompt is about to appear and overlays a fake one to capture credentials.
See also: ZynorRAT targets Windows and Linux systems
The researchers conducted their Android assessments on Google Pixel and Samsung Galaxy phones, finding that an unprivileged app can monitor another app's private storage folder. In tests against WhatsApp, the technique revealed when photos, videos, and documents were downloaded or sent, along with their file names, and also indicated when that media was later deleted.
The most significant problem in Windows arises when a user monitors the system root, as Windows reports the full path of every file that changes anywhere on the machine, including other users' home directories that the monitoring account cannot read. Firefox stores data for many websites in folders with the website name, allowing an unprivileged user to see in real time which websites another user is visiting.
The researchers achieved 97.8% accuracy for Firefox and 48.5% for Edge, which creates folders for far fewer websites. macOS leaks the least information, as only globally readable files can be tracked, but the researchers were still able to track app launches, app interactions, and settings changes.
The Linux kernel has been partially hardened so that device files no longer generate access and modification events, addressing the most serious issues, tracked as CVE-2025-68788. However, the researchers noted that there are no fixes for Android or macOS.
See also: QuimaRAT: New Java RAT targets Windows, Linux and macOS
Microsoft said that Windows' behavior is by design, revealing only file names and paths in another user's profile directory, not file contents or sensitive data. A Microsoft spokesperson commented, "We thank the researcher for reporting this behavior. We have investigated and determined that this is not a security vulnerability. The technique requires an attacker to already have the ability to execute code locally on a device under a separate user account and does not provide access to the contents of the files."
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
