Guide

How to tell if someone is using a mouse jiggler.

It usually starts with a feeling rather than a fact: someone is always green, never there. The status dot says active all day, yet messages sit unanswered and the work does not move. One possible explanation is a mouse jiggler: a USB gadget, an app, or a powered platform a real mouse sits on, all built to fake activity by moving the pointer automatically. Here is how to spot one, in plain English.

Six tell-tale signs.

Always active, never idle

Hours of unbroken "active" time with no natural pauses. People stop for coffee, calls and thought; jigglers do not.

Movement without interaction

The pointer moves all day, but there are no clicks, no typing and no application changes behind it.

Inhumanly regular motion

The same sweep or wiggle repeating on a fixed rhythm. Human movement is messy; synthetic movement is too smooth, too even, and never tires.

Activity that ignores context

"Active" straight through meetings, lunch and late evenings, with the same uniform intensity at 9am and 11pm.

Activity without output

Activity reports look full, but files, tickets and messages tell a different story. The gap between the two is the signal.

A second mouse nobody uses

For USB jigglers: a machine that quietly lists two pointing devices, one of which never seems to belong to anything on the desk.

How to check manually.

If you manage the machine, three checks cost nothing:

Look at connected devices. On Windows, open Device Manager and expand "Mice and other pointing devices"; on a Mac, check System Information under USB. A second, unexplained mouse is worth a question. The catch: USB jigglers deliberately identify as ordinary mice, so the name usually looks legitimate.
Look at running software. Check installed programs and startup items for known jiggler apps. The catch: they are easily renamed, and scripts can do the same job with no recognisable name at all.
Compare activity with output. Put the activity report next to actual work artefacts for the same period. The catch: this is slow, manual and easy to dispute without hard evidence.

And one type defeats all three checks: analogue movers, the powered platforms a real mouse sits on. Nothing extra is plugged in and nothing extra is running, because a genuine mouse is genuinely moving. The only trace they leave is the movement itself.

Why the movement is the only reliable signal.

Device lists can be fooled, process names can be changed, and analogue movers never touch either. What no jiggler can hide is the motion it produces. Machine-generated movement is statistically different from human movement: it repeats, it never fatigues, and it does not respond to anything on screen. That is why behavioural analysis of movement patterns catches all three types, including ones nobody has catalogued yet.

Or let JiggleGuard check for you.

JiggleGuard checks every endpoint roughly once a minute, separates human motion from synthetic movement, and turns detections into evidence: confidence level, timestamps and exportable reports. Windows and macOS. No keystrokes, no screenshots, no surveillance.

Get early access

Quick questions.

Do mouse jigglers show up in Device Manager?

USB jigglers do, but they identify themselves as an ordinary mouse, so the entry usually looks legitimate. Software jigglers appear as running programs, which can be renamed. Analogue movers never appear at all, because nothing extra is connected to the computer.

What does mouse jiggler activity look like in monitoring tools?

Typically constant active time with no idle gaps, pointer movement with few or no clicks or keystrokes, and uniform activity at unusual hours. Most monitoring tools count this as genuine activity, which is exactly the problem.

Is using a mouse jiggler against company policy?

That depends on the policy. Many organisations treat simulated activity as misuse of company equipment or a misrepresentation of working time. If your acceptable-use policy does not mention fake activity yet, defining it clearly is a sensible first step before acting on any detection.