A Critical Flaw Exposes User Activity Across Multiple Operating Systems
Researchers at Graz University of Technology in Austria have uncovered a flaw that allows malicious actors to monitor user activity on Linux, Android, Windows, and macOS systems. The vulnerability lies in the file-change notification features built into these operating systems, which can be abused to track users’ every move from the rhythm of their typing to the websites they visit.
The issue arises because applications can request notifications when files are created, modified, or deleted. This feature requires only read access to the location being watched, meaning that an attacker with a separate account on the system can easily exploit it. Text editors, file managers, sync clients, and antivirus software often use this capability, making them potential vectors for exploitation.
The researchers demonstrated that by monitoring file events, an attacker can reconstruct user, application, and system activity without ever exposing file contents. For example, they showed that file names and timing of events are enough to track which websites a user is visiting through the web browsers’ folder structures. On Linux, an attacker can even watch protected files by monitoring the folder that contains them, as long as that folder is readable.
The study found that these attacks work across multiple platforms. On Android, a malicious app with no permissions can monitor another app’s private storage folder, revealing information such as when photos, videos, and documents were received or sent, along with their file names. In tests against WhatsApp, the technique revealed when media was later deleted.
The most concerning aspect of this vulnerability is that it allows an attacker to access sensitive information without requiring any special privileges. On Windows, for instance, monitoring the root of the system drive reveals the full path of every file changed anywhere on the machine, including inside other users’ home directories that the monitoring account cannot read.
While patches have been partially implemented for some scenarios, most attack vectors remain unaddressed. The Linux kernel has been hardened to prevent device files from generating access and modify events (CVE-2025-68788), but no fixes have been issued for Android or macOS. Microsoft has stated that this behavior is by design and does not provide access to file contents or sensitive data, but the researchers argue that it still poses a significant risk.
To protect themselves, users should follow basic security best practices, such as limiting local access to trusted users and keeping systems up to date. Administrators can also enable certain protections documented in April 2025 for directory change notifications involving file-path disclosure scenarios.
Source: SecurityWeek — 2026-09-25