File Notification Attacks Let Hackers Track Keystrokes and Website Visits on Linux, Windows and macOS
Researchers showed file-notification APIs can leak keystrokes and website visits on Linux, Windows, and macOS.
64
Organization
Graz University of Technology
- Mentions · 7d0
- Mentions · 30d0
- All mentions5
- First seenSep 24, 2026
- Last mentionedSep 29, 2026
Timeline
5 articles · newest firstNew File Notification Attack Lets Hackers Track User Activity Across Linux, Windows and macOS
Graz University of Technology researchers show file-notification APIs (inotify, ReadDirectoryChangesW, FSEvents) leak user activity across Linux, Windows, macOS without privileges.
60
Other users can watch your browsing and time your keystrokes through OS file notifications
Graz researchers showed local accounts can infer browsing and keystroke timing through OS file notifications.
62
Windows, Linux, Android File Notification Systems Leak User Activity
Graz researchers show OS file-change notifications can reveal other users' activity without exposing file contents.
58
Decades-old file security flaws found in Android, Linux, macOS, and Windows
TU Graz researchers showed file-notification side channels on Linux, Windows, Android, and macOS leak user activity.
68
Related CVEs
by mentions- CVE-2025-68788<1%—Linux kernel: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users…
- CVE-2025-277383%6.5Improper access control in Windows Resilient File System (ReFS) allows an authorized attacker to disclose information over a network
- CVE-2025-211973%6.5Improper access control in Windows NTFS allows an authorized attacker to disclose file path information under a folder where the attacker doesn't have…
Appears with
- Linuxproduct · 4
- macOSproduct · 4
- Applevendor · 4
- Microsoftvendor · 4
- Firefoxproduct · 4
- Windowsproduct · 4
- Androidproduct · 4
- Googlevendor · 3
- WhatsAppproduct · 2
- Microsoft Edgeproduct · 2
- KDE Plasmaproduct · 2
- Appleorganization · 1
- Firefoxorganization · 1
- ACMorganization · 1
- Edgeorganization · 1
- KDEorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.