Suspicious Facebook message and app installation on my iMac

Question

Level 1

15 points

Suspicious Facebook message and app installation on my iMac

I had a message from a facebook group. went to facebook, immediate was switched from the page to another page, then told that my computer (account) had been shut down, Microsoft defender disabled, but not to shutdown my computer. That last part is what I sometimes see and is clearly someone trying to get me to do something I shouldn't do. So I shut down. Restarted. noticed a pop up saying an app had been added ---tried to find it with no luck I believe the app had something to do with messages/address and started Background. I should have looked at that more closely.

My question is does this sound familiar? was the original message legitimate? Is there something I should be doing. Any suggestions as to find that app that was loaded onto my computer.

Thanks

[Re-Titled by Moderator]

Original Title: Facebook message "Your compute had been shutdown Mcrosoft defender disable" etc. Clear scam, Deleted account. Any other steps I need to take

Posted on Jul 23, 2025 7:45 AM

Reply

Answer 1

Top-ranking reply

Mac Jim ID

Level 9

58,304 points

Jul 23, 2025 11:50 AM in response to Quolla6

Quolla6 wrote:

I've identified the added app as Background Assets Service using the Directory utility. It doesn't show up using the find function. I assume it's hidden in someway.

Not sure if you are referring to the BackgroundAssets Framework. This is part of MacOS installed on all users System folders and cannot be deleted, or even modified by any nefarious bad actor. When using the search option in Finder, the System files do not show up, but they are not hidden. The exact location is at /System/Library/Frameworks/BackgroundAssets.framework.

Not sure how the Directory Utility is involved at all in search for an installed app. To get a better idea of any third party processes that are installed on your Mac, the best way to do that is to use the free EtreCheck report and post using the Additional Text option when posting. The report contains no personal information. I don't suspect you have anything installed from the Facebook scam you were exposed to, but that would be a way to make absolutely sure:

How to use the Add Text Feature When Post… - Apple Community

Reply

Answer 2

Old Toad

Level 10

215,088 points

Jul 23, 2025 11:16 AM in response to Quolla6

You could use this app, AppCleaner to remove the app and any supporting files.

I have many 3rd party apps installed and do not have the Background Assets Service app on my Mac.

WARNING: If you use AppCleaner on an app that you have other apps from the same developer, like Adobe, you must be extremely careful checking all checkboxes and deleting. Some for those files may support other apps from the same developer and deleting them can mess them up. Adobe apps is a primary example. I know from experience. For singular apps from a developer it's safe.

If after removing the Background Assets Service app and it's supporting files you still get the notifications give this a try:

Reply

Answer 3

Aug 5, 2025 7:23 AM in response to Quolla6

iMacs dont have windows defender.. its 100% a scam heres the safety measures of MacOS https://support.apple.com/guide/security/gatekeeper-and-runtime-protection-sec5599b66df/web

https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/web

Reply

Answer 4

Quolla6 Author

Level 1

15 points

Jul 23, 2025 10:07 AM in response to Quolla6

Trying again, with better detail.

I've identified the added app as Background Assets Service using the Directory utility. It doesn't show up using the find function. I assume it's hidden in someway.

My understanding is that this is an app used by application developers for Apple products.

I'm assuming it was added as part of the scam. Doesn't sound like its something I need.

How do I delete it? And is there anything else I need to in response to the app having been added.

Bill

Reply