An Event Tap is a macOS mechanism for intercepting input events, such as keyboard and mouse activity, before or after they are delivered to applications. It is used for event monitoring, accessibility tools and input filtering, and it can observe or modify user input if granted the required system permissions.
How Event Taps Work
An event tap sits in the macOS event stream and lets a process inspect input before it reaches an application, or after the system has processed it. That placement makes it useful for accessibility, input monitoring and input filtering, but it also means the tap operates at a sensitive boundary where user interactions can be observed or altered.
In practice, the distinction between pre-delivery and post-delivery matters. A pre-delivery tap can influence what the target app receives, while a post-delivery tap is better suited to observation and telemetry. That architectural choice affects both the tap’s power and the level of trust macOS needs to grant it.
Permissions and Trust Boundaries
Event taps are not ordinary app callbacks, they require system permission because they can see keyboard and mouse activity. On modern macOS deployments, that usually places them inside the broader accessibility and input-monitoring trust model, where the operating system separates benign assistive tooling from software that could intercept sensitive user actions.
The security boundary is important because input streams often contain credentials, one-time codes, search terms, document edits and other high-value data. When a tool can observe or rewrite those events, the operator must assume that the tool has access to whatever a user types or clicks while the tap is active.
Common Uses and Legitimate Monitoring
Event taps are commonly used by accessibility software, hotkey managers, automation utilities and security tools that need visibility into user input. That makes them a legitimate part of macOS usability and endpoint control, not inherently malicious behavior.
The same mechanism can also support input filtering, such as suppressing or rewriting keystrokes before they reach an app. In well-designed tools, that capability is constrained to a narrow purpose and paired with clear user consent, because broad interception quickly crosses from convenience into surveillance risk.
Security Implications of Input Interception
Because event taps can observe raw input, they are valuable to attackers who gain code execution on a Mac and want to capture credentials or manipulate user actions. They are also attractive for covert persistence when malware wants to watch for passwords, approval dialogs or security prompts without relying on visible browser or application hooks.
Defenders therefore treat event taps as a control surface, not just an API. If an unknown process has input-monitoring access, or if a legitimate tool behaves unexpectedly, the issue is not only privacy, it can be a sign of endpoint compromise or abuse of trusted accessibility permissions.
Risk and Threat Considerations
Event taps create concentrated exposure because one granted permission can reveal a broad stream of user activity across many applications. The risk is highest when a tap is installed by untrusted software, when the system is already compromised, or when users approve permissions without understanding that the process may read and reshape input.
Failure mechanism: A malicious or compromised process abuses the event stream to capture sensitive keystrokes, suppress user actions, or inject misleading input before the user notices.
Impact: Exposed credentials, hijacked sessions, altered commands and higher-confidence phishing or fraud inside the local desktop session can follow.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Event taps can expose user input tied to authentication events. |
| AU-6 — Audit Review, Analysis, and Reporting | Input-monitoring tools should be reviewable when they capture sensitive activity. | |
| AC-6 — Least Privilege | Event taps require elevated trust, so access should be minimized. | |
| Recommendation — Harden user authentication flows to limit what intercepted input can reveal. Review logs and alerts for unexpected input-monitoring behavior. Restrict accessibility and input-monitoring permissions to approved software. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Event-tap permissions are a privileged local access path. |
| CIS-8 — Audit Log Management | Monitoring privileged input-capture software depends on visibility. | |
| Recommendation — Approve and revoke input-monitoring access only for necessary tools. Monitor endpoint logs for newly granted accessibility or input-capture permissions. | ||
| MITRE ATT&CK | T1056 — Input Capture | Event taps are an input-capture mechanism that can be abused by malware. |
| Recommendation — Map suspicious event-tap activity to input-capture detection and containment. | ||
Practitioner Guidance
What to watch for: Review any software that requests input-monitoring or accessibility permissions, especially tools that are not clearly tied to a known accessibility or endpoint-control use case. On managed Macs, keep a tight inventory of permitted input-interception tools and remove stale or unnecessary approvals.
Governance implication: Treat event-tap-capable software as privileged endpoint software, because its trust boundary is closer to keyboard capture than to ordinary UI automation. That is especially important where users handle secrets, admin commands or regulated data on the same workstation.
Related resources from NHI Mgmt Group
- What makes Shai Hulud 2.0 different from a normal npm malware event?
- What is the difference between quarterly certification and event-driven access control?
- When does event-driven IAM reduce risk more than periodic access reviews?
- When should organisations treat a successful login as a security event?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org