# A colleague says the mouse moved by itself. Is someone controlling the computer?

Possibly, so check rather than dismiss it. Hardware explains many cases: a failing mouse, a wireless receiver picking up another device, or a touchpad reacting to a sleeve. Remote control is the other explanation, either by your own IT support or by someone else using a remote-access tool. Ask IT whether anyone was connected at that moment, look at the computer's installed programs and running remote-support tools, and check whether new accounts, password changes or payments followed. If nobody can explain it, disconnect the computer from the network, leave it powered on and call your incident-response provider. Remote-control tools need a network connection, often to a vendor's relay server, so the traffic is there to see: NetSenX shows that computer's connections and flags regular check-ins with a new outside server as beaconing, on every plan.

FAQ: [Have I been hacked?](https://netsenx.com/en/faq/signs) · https://netsenx.com/en/faq/the-mouse-moved-by-itself-is-someone-controlling-the-computer

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing

## Related questions

- [How do we check a suspicious computer without tipping off the attacker?](https://netsenx.com/en/faq/how-to-check-a-suspicious-computer-without-alerting-the-attacker)
- [How do I know if my business network has been compromised?](https://netsenx.com/en/faq/how-do-i-know-if-my-business-network-has-been-compromised)
- [Can an attacker stay inside a network for years without being noticed?](https://netsenx.com/en/faq/can-an-attacker-stay-inside-a-network-for-years-without-being-noticed)
- [What free checks can I run today?](https://netsenx.com/en/faq/what-free-checks-can-i-run-today)
- [Does NetSenX replace antivirus or EDR?](https://netsenx.com/en/faq/does-netsenx-replace-antivirus-or-edr)