Most people who care about online privacy focus on the obvious stuff — running a VPN, checking for DNS leaks, making sure WebRTC isn’t exposing their real IP. That’s all important. But there’s a layer of the problem that gets almost no attention, and it lives right inside your own machine.
Your Mac is talking to the internet right now. Some of it you know about — your browser loading pages, your email client checking for new messages. But some of it you didn’t ask for, didn’t approve, and probably have no idea is happening.
That’s the part worth paying attention to.
The Assumption Most People Get Wrong
There’s a common belief that Macs are inherently secure, and compared to other platforms, they hold up pretty well. But “more secure” isn’t the same as “private.” These are two very different things, and confusing them leads people to feel safer than they actually are.
A secure system means it’s harder for attackers to break in. A private system means it doesn’t leak your data without your knowledge. You can have one without the other, and most standard Mac setups sit somewhere in the middle — reasonably secure, but quietly leaking more than their owners realise.
The leaks don’t always come from malware. Sometimes they come from legitimate processes being exploited. Sometimes they come from background daemons doing their jobs a little too enthusiastically. And sometimes they come from software that’s technically allowed to run but behaves in ways you’d never sign off on if someone asked you directly.
What’s Actually Running in the Background
Open Activity Monitor on your Mac right now. Go to the Network tab and sort by “Sent Bytes.” Take a look at what’s making outbound connections.
For most people, this is the first time they’ve seen this screen. It’s surprising. There are processes running that you may not recognise names like nsurlsessiond, symptomsd, cloudd, callservicesd, and others. Some of these are completely routine. Some of them are worth a second look.
The one that generates the most concern and the most confusion is nsurlsessiond.
NSURLSessionD: Legitimate Process, Serious Risk
NSURLSessionD is a genuine macOS daemon. Apple built it in, and on its own, it’s not malicious. It handles background network tasks: caching, cookie storage, redirect handling, background file transfers, and syncing with services like iCloud. When your Mac quietly finishes uploading a folder to iCloud while you’re doing something else, NSURLSessionD is probably involved.
So far, so normal.
The problem is what can happen when a browser hijacker or malware gets its hands on this process. Because NSURLSessionD already has legitimate network access — it’s a trusted system process — it becomes an ideal vehicle for bad actors. A hijacker piggybacking on NSURLSessionD can:
- Reset your browser’s settings and lock down your homepage
- Redirect links to destinations you didn’t choose
- Use the daemon’s network access to sync your private data to an unknown external server
That last one is the serious part. Your files, your browser session data, your cached credentials — potentially being moved to a server you’ve never heard of, through a process that macOS treats as trusted.
And because it’s a daemon rather than an obvious application, you won’t see it in your Dock. You won’t get a prompt asking if you want to allow it. It just runs.
How a Mac Gets to This Point
People often assume Mac infections require some dramatic failure of judgment — clicking an obviously suspicious link, downloading something from a shady website. In reality, the entry points are often surprisingly mundane.
Software bundling is one of the most common. You find a free utility somewhere, download it, install it, and buried inside the installer is something you never agreed to. The installer presents its terms in a long block of text nobody reads, and by the time you’ve clicked through, a background process has been added to your startup items.
Compromised websites are another route. You don’t have to download anything. Simply visiting a page that has been injected with malicious code can, in some configurations, trigger an automatic download and installation of a browser hijacker — without any confirmation prompt appearing.
Fake system alerts round out the top three. A pop-up appears while browsing, designed to look exactly like a macOS notification. It tells you that your Mac is infected, or that a plugin needs updating, or that some critical download is required. People who know to ignore these usually do. People who don’t, don’t.
Once any of these delivers a hijacker to your system, NSURLSessionD is a natural target — precisely because it’s already trusted, already has network access, and already makes outbound connections that look routine.
The Signs That Something Is Off
The thing about a process like NSURLSessionD being exploited is that the symptoms look a lot like ordinary Mac performance issues. That’s part of what makes it tricky to diagnose.
Here’s what to watch for:
Unusually high CPU or memory usage — especially when you’re not doing anything demanding. If your fan is spinning and Activity Monitor shows NSURLSessionD consuming significant resources while your Mac should be idle, that’s worth investigating.
Your Mac running hot for no obvious reason — an overworked CPU generates heat. If your MacBook is consistently warm when you’re just sitting on the home screen, background processes are working harder than they should.
Slow network performance — if a hijacker is using NSURLSessionD to move data to an external server, it’s competing with your legitimate internet usage. Downloads that used to be fast become sluggish. Pages load slower. Video calls drop.
Browser behaviour that’s changed without your input — your default search engine is different, your homepage has changed, links sometimes redirect to unexpected places. These are classic browser hijacker symptoms, and NSURLSessionD is frequently the delivery mechanism.
Connections to unfamiliar IP addresses — this is the one most people never think to check. Tools that analyse your outbound network activity can show you exactly which IP addresses your Mac is connecting to, and flag anything that doesn’t match known Apple or legitimate third-party services.
That last point matters more than most people realise. Checking what your browser is sending out is common practice among privacy-conscious users. Checking what your entire machine is quietly transmitting is rarer — and arguably more important.
What You Can Actually Do
Check Activity Monitor regularly. The Network tab is the one to focus on for this kind of issue. If you see NSURLSessionD consistently at the top of the list when your Mac should be idle, start investigating.
Audit your browser extensions. Browser hijackers very often install themselves as extensions — they’re harder to spot there than in your Applications folder, and many users have accumulated extensions over years and don’t remember what each one is for. Remove anything you don’t recognise or actively use.
Look at your Login Items. Go to System Settings > General > Login Items and review everything that’s set to launch at startup. Unknown or unfamiliar items here are a red flag.
Check for unknown applications. Go through your Applications folder and your ~/Library/LaunchAgents folder. The second location is where persistent background processes often hide — regular app uninstalling won’t touch them.
Learn to spot suspicious browser behavior — unexpected redirects, new toolbars, changed settings, search engines you didn’t choose. These are early warning signs that something has gained access to your browser’s configuration. If you notice these patterns, treating it as a potential hijacker situation rather than a glitch is the right instinct. A good guide onspotting suspicious browser behavior can walk you through the specific indicators and removal steps if NSURLSessionD is involved.
Consider what your VPN can and can’t do here. A VPN protects the contents of your outbound traffic from being read by third parties between you and the destination. It does not prevent a hijacker running locally on your machine from making outbound connections. If malware is already on your device, routing your traffic through a VPN doesn’t stop the malware from operating — it just means the data travels encrypted to wherever the attacker’s server is. Local security and network-level privacy are complementary, not interchangeable.
The Broader Point
Most privacy tools and practices are built around the idea of protecting your connection — your IP, your traffic, your DNS queries, your browser fingerprint. That’s a crucial part of the picture.
But the full picture includes your device. A Mac that’s running a browser hijacker on top of a solid VPN setup is still compromised. The data is still leaving. It’s just taking a different route to get there.
Real privacy means thinking in layers. What is your connection revealing? What is your browser revealing? And what is your machine doing on the network without you asking it to?
Most people have a decent answer to the first question and a partial answer to the second. Almost nobody has a clear answer to the third — until something goes wrong.
Getting ahead of that is worth the twenty minutes it takes to open Activity Monitor, look at what’s making outbound connections, and remove anything that shouldn’t be there.
Your VPN is doing its job. Make sure your Mac is doing its job too.