The Privacy and Security Diagnostic
On macOS, a small green dot in the menu bar indicates that your camera is active, and an orange dot indicates your microphone is listening. These hardware-level privacy indicators are excellent for alerting you that something is watching or listening.
However, macOS does not always clearly articulate which background process or invisible application is holding that hardware port open.
If you close Zoom, Microsoft Teams, and Skype, but the green camera light stays on, you have a problem. It could be a stuck video conferencing daemon, or in worst-case scenarios, malicious software secretly recording you.
To definitively identify exactly which application has hooked into your camera or microphone, system administrators use the lsof (List Open Files) command in the macOS Terminal.
Step 1: Understanding “Everything is a File”
In UNIX-based operating systems like macOS, the core philosophy is that “everything is a file.”
Your hard drive is treated as a file. Your network connections are treated as files. Crucially, hardware peripherals like your built-in FaceTime HD Camera and your internal microphone are also represented by the operating system as special device files.
Therefore, if an application wants to record video, it must “open” the camera file. The lsof command simply interrogates the operating system to see which applications have their hands on specific hardware files.
Step 2: Identifying Camera Usage
Apple routes the camera hardware through a specific system framework called “AppleCamera.” We can use the grep command to filter the massive output of lsof and only show results related to the camera.
Open the Terminal app (located in Applications > Utilities) and type the following command exactly:
lsof | grep "AppleCamera"
Because querying hardware states requires deep system access, you may not see all results as a standard user. It is much safer and more accurate to run this command with administrative privileges using sudo:
sudo lsof | grep "AppleCamera"
You will be prompted to enter your Mac password (the characters will not appear on screen as you type). Press Enter.
If the camera is active, the output will list the specific process name (e.g., zoom.us, obs, or VDCAssistant) alongside its Process ID (PID).
Step 3: Identifying Microphone Usage
Locating the microphone is slightly more complex because audio routing in macOS is handled by the CoreAudio daemon, rather than a single explicit hardware file.
However, we can look for processes that are actively engaging with the audio engine components.
Run the following command in Terminal:
sudo lsof | grep "AudioEngine"
Alternatively, you can check for processes hooking into the broader CoreAudio framework:
sudo lsof | grep "CoreAudio"
This will return a list of applications currently capable of playing or recording sound. You will likely see coreaudiod (the system audio manager) and whatever apps you currently have open, such as Spotify or a web browser.
Step 4: Terminating the Offending Application
Once you have identified the application that is secretly keeping your camera or microphone active, you need to shut it down.
Look at the output from Step 2 or Step 3. The second column in the terminal output is the PID (Process ID), a unique number assigned to that running application.
To force the application to quit instantly and release its grip on your hardware, use the kill command followed by the PID. For example, if the rogue application has a PID of 4092, you would run:
sudo kill -9 4092
The -9 flag sends a “SIGKILL” signal, which is absolute and cannot be ignored by a frozen or stubborn application. The green or orange indicator light on your Mac should instantly turn off.
Step 5: Resetting the Camera Daemon
Sometimes, the lsof output will reveal that a core Apple system process, such as VDCAssistant (Video Decode Acceleration), has crashed and left the camera engaged, even though no third-party apps are running.
In this scenario, you do not need to reboot your Mac. You can simply kill the system daemon. macOS will immediately restart it in a fresh, healthy state.
sudo killall VDCAssistant
If you are running a modern version of macOS, the camera daemon was renamed. If the above command says “No matching processes,” run this instead:
sudo killall AppleCameraAssistant