Many remote workers buy physical mouse jigglers to trick boss-tracking software. How do IT departments catch them?

A moving cursor is only one signal

A physical mouse jiggler keeps a cursor moving or periodically nudges the mouse. That can make software that measures idle time report less inactivity, but it does not create the other traces that usually accompany real work: opening files, editing documents, communicating with colleagues, or using business applications.

That gap matters because workplace monitoring rarely depends on a cursor alone. Depending on the tools an employer uses, IT may see application activity, device and sign-in records, security events, or work produced in shared systems. A cursor that moves while the computer shows little other activity may be noticeable—but by itself, it does not prove someone is using a jiggler or explain why they are idle.

How a device can come to IT’s attention

Some jigglers connect through USB; others physically move a mouse without connecting to the computer. A USB-connected device may appear in device-management or security logs, especially where an organization restricts unfamiliar peripherals. That gives IT a possible lead, not necessarily a verdict: many legitimate accessories also connect over USB, and a purely mechanical mover may leave no separate device record.

More commonly, concern may begin with a mismatch between activity indicators and the work systems themselves, or with a manager’s review of missed tasks or availability expectations. IT can examine technical records when there is a specific operational or security reason, while managers typically assess work against job responsibilities. The tools and rules differ by employer, so there is no universal detection method.

Why the trick has limits

A jiggler can alter an idle timer; it cannot make a person’s work appear in a project history or answer a message. Nor does a quiet activity record necessarily mean misconduct: reading, planning, calls away from the computer, and other legitimate work may generate little mouse input. The useful distinction is between simulated input and evidence of work—not simply between a moving and a still cursor.