[blank] wants to access key "mgn" in your keychain

[Ratsima]

See the attached screenshot.

I've gone through the system log to see if I can identify what this is, but nothing sticks out. I get this now and then. "mgn" is the SSID of my router, so it must have something to do with that, but what? I'm already connected, so why the request for access?

 

[AMACL]

I'm not an expert, but it doesn't look good. Do not click on anything until you are sure it's legit !
This resembles the kind of malware that is circulating nowadays.

 

[Ratsima]

Well, I run both DetectX and ClamAV every night and neither has detected anything.

 

[ferrarr]

See the attached screenshot.

I've gone through the system log to see if I can identify what this is, but nothing sticks out. I get this now and then. "mgn" is the SSID of my router, so it must have something to do with that, but what? I'm already connected, so why the request for access?

View attachment 30281

Which choice(s) have you made? Have you looked at Activity Monitor?

 

[Ratsima]

Which choice(s) have you made? Have you looked at Activity Monitor?

I've always just picked "Deny". I have top running in a terminal session at all times. No clue there.

Next time I'll open Activity Monitor and see if it sheds any light.

 

[pm-r]

I've gone through the system log to see if I can identify what this is, but nothing sticks out

Anything that gives a hint of anything to do with any Thailand agency or government department???

Try googling the name of what is actually asking.

And I doubt that either DetectX and ClamAV will pickup an "active" process.


- Patrick
======

 

[Ratsima]

There's nothing in the system log at all.

I don't know the name because it's not in the dialog box. Perhaps if I had clicked the ? I'd know more.

Next time.

 

[pm-r]

Is there really nothing ie: blank ahead of the "wants to access key "mgn" in your keychain" phrase as in the screen shot???

That seems a bit bizarre, or is the icon expressing that it's some "locked" (the padlock) "application" (the generic application icon)????

Whatever app that might be???



- Patrick
======

 

[harryb2448]

Office 2019 went through this silly 'wants access' business but that was on opening any of the Office apps.

 

[Ratsima]

Is there really nothing ie: blank ahead of the "wants to access key "mgn" in your keychain" phrase as in the screen shot???

That seems a bit bizarre, or is the icon expressing that it's some "locked" (the padlock) "application" (the generic application icon)????

Whatever app that might be???
======

Correct on all counts. There is no application name anywhere. It is indeed a locked, generic application icon.

I went through the system log, line by line up through the time I took the screenshot and there is no indication that any application asked for Keychain access or was denied. The string "mgn" appears nowhere in the system log.

Next time, gotta remember to click on that question mark. I'm sure there's a clue there.

 

[pm-r]

Next time, gotta remember to click on that question mark. I'm sure there's a clue there.

I guess it won't hurt to try, but usually clicking on the question mark just produces a rather vague generic description of what has happened without any specific details.

Maybe it's just an odd quirk of Mojave or whatever Mac OS version you are using.


- Patrick
======

 

[Ratsima]

Well, it hasn't showed up for a few days now, so I may never get a chance to click on that question mark.

 

[zerozero]

Hi everyone, I seem to have the same issue, and for several times already. Have you got any update on this?

I've got some screenshots here: Imgur: The magic of the Internet

The icon in the pop-up looks different from OP's (mine looks like it's cropped/modified/incomplete, just weird looking). Clicking on the question mark of the pop-up will just open the help guide (as in the second image), which isn't really of any help.

I'm not familiar with computer stuff and I'm extremely worried that my computer might have been hacked or something. Here are some more details for you guys, let's see if this helps. I was and am using MacBook Pro (2016) macOS Sierra version 10.12.6, and also an AirPort Time Capsule.

The first time this happened was in late August 2019. I received an email from Microsoft saying my Skype account (which I have not used for many years) was compromised and so I went through the process trying to secure this account even though I don't intend to use it anymore. At some point of this account-securing process, I was shocked to see this pop-up for the first time. I clicked Deny and nothing seemed to have happened. After I secured this account, I could see from the account log-in activity that the hacker came from China, and I also googled that there were quite a number of similar Skype account hacking reported on reddit forum around that period.

The second time I got this pop-up was when I was browsing a support article on Apple's website yesterday. Not sure if related at all, but I saw in the Activity Monitor there's a "Safari Service Worker (https://e.infograms.com)" that's using quite some CPU power.

The third time was after I uploaded the above screenshots to Imgur just now.

It seems this is like a very rare issue and I could only find 2 results in google:
Suspicious Keychain Auth request popup - Ars Technica OpenForum
wants to access key "[name of my SSID]" in your keychain. Do you want to allow access to this item?

Appreciate if anyone can help! Thanks a lot!