Many security tools, remote-desktop solutions, banking apps, crypto wallets, trading platforms, and even some games now run “user presence” or “liveness” checks. The idea is simple: if nobody is physically moving the mouse or typing, the session should lock, log out, or block sensitive actions.
Attackers bypass these checks by generating realistic (or just good enough) fake mouse movements and keystrokes. In 2025–2026 this technique shows up in almost every serious remote-access trojan (RAT), infostealer post-exploitation phase, and most ransomware manual operations.
Why These Checks Exist & How They Usually Work
1. Financial institution/trader applications: "Still with me?" → mouse or keyboard not used for a period of time → session times out or requires additional security measures.
2. EDR/XDR agents: recognized via unattended system to determine/alert of remote administration being used.
3. Remote desktop / VNC / RDP monitoring: lock screen if no input for X minutes.
4. Crypto Wallets/Exchanges & Withdrawals Will Require Periodic Mouse Movement To Prove A Human Is Operating The Account.
Most Commonly, The Following Inputs Will Be Monitored For Activity:
1. A Change In The Position Of The Mouse
2. Mouse Clicks (Left or Right)
3. Keyboard key presses (any key)
4. Sometimes scroll wheel or touchpad gestures
If none happen for 1–15 minutes → trigger lockout / alert.
How Attackers Fake Human-Like Input
They use several practical methods , ranked from most common to most sophisticated.
1. Attacker Use Dummy Keysea Created By An App (Most Common/Basic Method): The Most Popular Method Of Human-Like Input Is Periodic Keyboard Duplicates And Mouse Movement Using Malware To Enter A Harmless Key every 20 to 50 Seconds and To Move The Mouse 1 To 5 Pixels Randomly. Many banking RATs and stealers do exactly this.
Example Python snippet attackers actually use (obfuscated variants common):
import pyautogui
import time
import random
while True:
pyautogui.moveRel(random.randint(-5,5), random.randint(-5,5), duration=0.2)
pyautogui.press('shift')
time.sleep(random.uniform(25, 55))
2. Mouse movement patterns that look human Instead of tiny wiggles, they simulate real curves / bezier paths:
a) Move cursor in smooth arcs
b) Occasionally “hesitate” (small pauses)
c) Randomly click non-interactive areas
d) Scroll a little every few minutes
Tools attackers use: AutoIt, AutoHotkey, Python + pyautogui, C# + Windows API (SendInput).
3. Hardware emulation will be more difficult to detect:
a) USB Rubber Ducky and BadUSB devices use the hardware level to simulate a physical keyboard or mouse input.
b) Virtual HID drivers are a custom kernel driver that will register fake keyboard and mouse devices within the OS.
c) High-end banking Trojans and some APT toolkits use this technique.
4. RDP / VNC session injection: Attacker already has remote access → injects mouse/keyboard events directly into the RDP/VNC stream so the target machine thinks a real user is present.
Real-World Scenarios Where This Is Used
1. Banking Trojan that Keep the Session Alive – Attacker has logged into the Victim's Online Banking Account, Malware Moves the Mouse Every 45 Seconds So That the Session Will Not Time Out; Therefore, the Attacker Will Be Able to Drain The Victim's Bank Account Over Hours/Days.
2. Infostealer waiting for high-value copy-paste Lumma/RedLine variant wiggles mouse + presses Scroll Lock every 30–60 s → keeps Windows active → waits for victim to copy crypto address → swaps clipboard → victim sends funds.
3. Ransomware manual operator hiding presence Affiliate uses RDP to move laterally → injects fake mouse movements → EDR “user presence” check stays green → no alert for unattended remote session.
4. Crypto wallet drain during sleep Malware on victim’s laptop keeps system awake + simulates activity → waits until victim sleeps → opens wallet → transfers funds.
How Defenders / Users Can Detect or Mitigate
1. EDR / XDR rules Alert on repeated mouse movement / keypress patterns from processes that aren’t explorer.exe or desktop apps (e.g., pyautogui from cmd.exe).
2. Behavioral monitoring Look for mouse events with zero human variance (perfect 5-pixel wiggles every 30 s exactly) → flag as automation.
3. User education “If your mouse cursor moves by itself or you see random typing → disconnect immediately, scan, change passwords.”
4. Endpoint controls Block or monitor pyautogui / AutoIt / AutoHotkey execution (Sysmon rule: Image contains “pyautogui” or “AutoIt”).
5. Physical checks If you see mouse moving when no one is touching it → assume compromise.
This technique is low-sophistication but extremely effective because it exploits the weakest link: the assumption that “if there’s mouse/keyboard activity, a human is present.”
One extra look at the screen when something feels off can stop a lot of these attacks.
