VORANT. Threat Intelligence Sign in Get the full feed

Shazam for Mac keeps mic recording when 'off'

routine vulnerability

Reverse-engineering of Shazam's macOS app found it continues recording from the internal microphone even after the user toggles it 'OFF', though it doesn't appear to process or exfiltrate the audio.

A researcher reversed the Shazam macOS application after a user reported that OverSight (a tool that alerts on webcam/mic access) never showed a 'Mic Deactivation' event when Shazam was toggled off. Deep analysis of the Objective-C code and ShazamSDK.framework revealed that toggling the app to 'OFF' only stops the app from processing captured audio (via a 'generating' flag) rather than actually halting the low-level AudioOutputUnitStop() call that would stop the microphone stream. The 'taggingType' value is hard-coded such that the condition needed to trigger 'stopRecording' is never satisfied, meaning the mic remains active and recording continues in the background regardless of the UI toggle state.

The researcher found no evidence that this recorded audio is saved, processed, or exfiltrated when the app is in the 'OFF' state — the flaw appears to be an oversight rather than intentional spying. However, the behavior is concerning from a privacy standpoint, as it means malware or a compromised process could potentially piggyback on this always-on recording state without triggering typical mic-activation alerts. The researcher contacted Shazam prior to publication; the vendor confirmed the technical findings and indicated a fix would be addressed in a future update.

This is a privacy/behavioral disclosure rather than an active exploit or malware campaign — no IOCs, threat actors, or active exploitation are involved. It serves as a case study in how legitimate apps can inadvertently retain sensitive hardware access beyond user-intended controls, and highlights the value of tools like OverSight for auditing mic/camera usage on macOS.

Detection guidance

Microphone Access Without Deactivation Alert

ATT&CK T1123

Detects persistent microphone stream access by Shazam or similar audio apps when user-facing recording toggle is in OFF state, indicated by absence of AudioOutputUnitStop or equivalent teardown call in process audio subsystem interactions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Microphone Access Without Deactivation Alert
description: Detects audio capture processes (including Shazam) that maintain active
  microphone streams despite user toggling the recording feature to OFF. Targets the
  behaviour pattern where the Audio Unit stream remains active and recording continues,
  not just processing stops. This rule monitors for sustained mic access without corresponding
  Audio Unit shutdown events.
tags:
- attack.discovery
- attack.t1123
logsource:
  category: process_access
  product: macos
detection:
  selection:
    TargetImage|endswith:
    - /Shazam.app/Contents/MacOS/Shazam
    - /AudioUnit
    CallTrace|contains:
    - AudioOutputUnitStart
    - AudioUnitStart
    EventType: CreateRemoteThread
  filter_expected_shutdown:
    CallTrace|contains:
    - AudioOutputUnitStop
    - AudioUnitStop
  condition: selection and not filter_expected_shutdown
falsepositives:
- Legitimate audio applications briefly maintaining mic streams during state transitions
- System audio services managing background audio capture for accessibility features
level: medium
id: e9894e2e-2352-5a11-89bf-c5b817d0e578
status: experimental
author: Vorant

Audio App Recording State Mismatch

ATT&CK T1123

Detects when audio capture applications (Shazam, music recognition tools) show UI state as OFF/disabled but continue holding active microphone device handles, indicating recording bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Audio App Recording State Mismatch
description: Detects audio application processes that claim to have disabled recording
  (via UI toggle or config flag) but retain active open file descriptors to audio
  input devices (/dev/audio*, CoreAudio HAL devices). The mismatch between logical
  state and actual hardware access indicates potential privacy bypass.
tags:
- attack.t1123
- attack.discovery
logsource:
  category: file_event
  product: macos
detection:
  selection:
    Image|endswith:
    - /Shazam.app/Contents/MacOS/Shazam
    TargetFilename|contains:
    - /dev/audio
    - CoreAudio
    Accesses: read
  filter_app_startup:
    CommandLine|contains: launch
  condition: selection and not filter_app_startup
falsepositives:
- Audio applications performing input device enumeration during initialization
- System audio framework maintaining device references for rapid re-enabling
level: medium
id: ce804bf2-e4de-522b-9dad-076b391587a1
status: experimental
author: Vorant

Disabled Audio App Maintaining Hardware Capture Stream

ATT&CK T1123

Detects sustained microphone hardware stream activity (no Audio Unit stop call) from audio apps when their recording feature is user-disabled, suggesting circumvention of intended privacy controls. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Disabled Audio App Maintaining Hardware Capture Stream
description: Monitors for the pattern where audio capture applications have a disabled
  or OFF recording state (detectable via hardened runtime or sandbox telemetry) but
  the underlying Audio Unit session remains open and active without corresponding
  stop/teardown syscalls. This reflects apps that suppress output/processing but not
  input stream termination.
tags:
- attack.t1123
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    Image|endswith: /Shazam.app/Contents/MacOS/Shazam
    CommandLine|contains:
    - AudioSession
    - AVAudioEngine
  selection_sustained_access:
    ParentImage|endswith: /Shazam.app/Contents/MacOS/Shazam
    Image|endswith:
    - /usr/libexec/coreaudiod
    CommandLine|contains: record
  filter_normal_lifecycle:
    CommandLine|contains:
    - stop
    - shutdown
    - disable
  condition: (selection_parent or selection_sustained_access) and not filter_normal_lifecycle
falsepositives:
- Rapid toggle-on-toggle-off sequences by users re-enabling recording immediately
- Audio framework housekeeping maintaining device connections across brief state changes
level: low
id: 04210110-5c15-57ba-89fb-ba7de61dc2fd
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x13.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free