Fundamental Flaw in File Monitoring APIs Exposes Keystrokes and App Activity Across Windows, Linux, Android, and macOS

Researchers from Graz University of Technology have published work showing how standard file-monitoring subsystems can be abused to leak private information across major operating systems.

The affected components are inotify in Linux, FileObserver in Android, ReadDirectoryChangesW in Windows, and FSEvents in macOS. These interfaces report when files are opened, modified, or deleted and can be accessed by unprivileged users who have directory-level permissions.

On Linux, access to the /dev/input directory allows an attacker to observe timestamped events from /dev/input/event4. By measuring intervals between keystrokes, researchers reconstructed typed text with accuracy between 93% and 100%. The attack also works over SSH sessions.

Android’s FileObserver breaks application isolation, enabling a malicious app to monitor messaging events such as document or media transfers in other applications.

In Windows, monitoring browser cache files revealed visited websites with 97.8% accuracy. On macOS the technique was less powerful but still exposed system events including audio device changes and Bluetooth updates.

Partial fixes appeared in Linux in December 2025 and an optional Windows policy was introduced, yet both remain insufficient. No patches exist for Android or macOS. Researchers also demonstrated an ongoing Linux attack that detects password prompts to overlay a fake login window.

Additional items reported this week include the MacSync infostealer for macOS that abuses iCloud infrastructure, a practical 1024-bit RSA factoring method, a flaw in the Muse AI assistant on macOS, a critical WordPress vulnerability affecting versions from 4.7 onward, an unpatched issue in Windows Defender, and zero-days in Citrix NetScaler and the D-Link DIR-822A router.