Pasted a command in Terminal? Check your Mac now.

1What the pasted line does

Since late 2025, fake pages for AI tools and "clean up your Mac" search ads have asked Mac users to open Terminal and paste one line. Sophos traced three campaigns between November 2025 and February 2026 that installed the MacSync stealer this way: the line downloads a script, asks for your Mac's password, then takes keychain data, saved logins and crypto wallet recovery phrases (The Hacker News, 16 March 2026). Microsoft reports the same lures for the Atomic (AMOS), MacSync and DigitStealer stealers, often reached through search ads (Security Affairs on Microsoft's report, 4 February 2026).

Why nothing warned you: macOS asks before you first open software downloaded from the internet (Apple Platform Security), and it knows a file came from the internet by a quarantine flag that browsers set. Files fetched with curl in Terminal may not get that flag (MITRE ATT&CK T1553.001), and a script piped straight into bash is never opened as an app at all, so the prompt never appears.

The lines usually look like one of these, with a web address in the middle:

• curl -fsSL https://… | bash
• bash -c "$(curl -fsSL https://…)"
• echo … | base64 -d | sh

2Check 1: login items and background apps

Open System Settings → General → Login Items & Extensions (on macOS 14 and earlier: Login Items). Look at Open at Login and Allow in the Background.

Anything you don't recognise is worth a closer look, above all an item with an odd name, no developer shown, or one that appeared on the day you pasted the command. Turning a background item off stops it from starting again; it doesn't delete it.

3Check 2: launch agents and daemons

Programs that start by themselves leave a small file in one of three folders. This lists them, newest first:

ls -lt ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons

Most names look like com.company.app.plist. Look for files dated around the day you pasted the command, names that imitate Apple (com.apple…) inside your own Library folder, or names made of random letters. To see which program a file starts, replace NAME with its name:

plutil -p ~/Library/LaunchAgents/NAME.plist

4Check 3: your shell startup files

Your shell runs these files every time Terminal opens, so a stealer can hide a line there. This shows when each was last changed:

ls -lT ~/.zshrc ~/.zprofile ~/.bash_profile ~/.bashrc ~/.profile 2>/dev/null

If one changed on a day you don't remember editing it, look at its last lines:

tail -n 20 ~/.zshrc

Lines you didn't write that mention curl, base64, osascript or a web address are a finding.

5Check 4: what you pasted

Terminal keeps the lines you ran. This shows the last 30 that downloaded or decoded something:

grep -E 'curl|wget|base64|osascript' ~/.zsh_history | tail -n 30

6Check 5: apps macOS wouldn't accept

macOS's Gatekeeper can tell you which apps in your Applications folder it wouldn't accept (not signed by an identified developer, or not checked by Apple):

for a in /Applications/*.app; do spctl -a "$a" 2>/dev/null || echo "Not accepted: $a"; done

Some old or open-source apps show up here and are fine. An app you don't remember installing is the finding. Do the same by eye for your Downloads folder, newest first:

ls -lt ~/Downloads | head -n 20

7Check 6: remote access and profiles

Open System Settings → General → Sharing. Screen Sharing, Remote Login, Remote Management and File Sharing should be off unless you use them yourself.

Then open System Settings → General → Device Management (on older macOS: Privacy & Security → Profiles). A profile you didn't install can send your browsing through someone else's server or trust their certificates. Remove one only if you're sure it isn't from your school or employer.

8Check 7: who is talking to the internet

This counts the open internet connections per program:

lsof -nP -iTCP -sTCP:ESTABLISHED | awk 'NR>1 {print $1}' | sort | uniq -c | sort -rn

Your browser, Mail, Messages and iCloud are normal. A name you don't know, or a script runner such as osascript, python3 or curl holding connections, is worth a look. To see programs waiting for connections from other computers:

lsof -nP -iTCP -sTCP:LISTEN

9If you find something

1. Disconnect from Wi-Fi and unplug any network cable.
2. From another device, change the passwords for your Apple Account, your email and your bank first, sign out every other session, and turn on two-factor authentication.
3. Treat every crypto wallet whose recovery phrase or keys were on this Mac as lost. Create a new wallet on a clean device and move the funds. A stealer may already have the phrase, and a transfer can't be undone. See crypto wallet safety.
4. Remove what you found: quit it in Activity Monitor, delete the launch agent file and the app, and restart. If you're not sure you found everything, back up your documents (not your apps) and erase the Mac: System Settings → General → Transfer or Reset → Erase All Content and Settings.
5. Saw an alert that malware was blocked and moved to the Trash? That is XProtect, the Mac's built-in protection, removing a file it recognised. Good, but check where the file came from: the same site may have sent more. See what the Mac's built-in protection does.

10Before you paste anything into Terminal again

• Type the address of the site yourself; don't follow an ad or a link in a chat.
• Read the line before you paste it. | sh, | bash, base64 and osascript mean it runs something.
• No real fix for a website, a captcha or a "broken" download needs Terminal.
• If a line asks for your password, stop and ask yourself what it's for.

11Questions

My Mac was hacked. What do I do first?

Disconnect it from the internet, then use another device to change your Apple Account, email and bank passwords and sign out every other session. Move any crypto whose recovery phrase was on the Mac to a new wallet made on a clean device. Then do the checks on this page or erase the Mac.

How can I tell if my Mac is hacked right now?

Look for login items or launch agents you don't recognise, shell files you didn't change, apps macOS wouldn't accept, and unknown programs with internet connections. Password prompts you didn't trigger and browser settings that changed by themselves are signs too.

macOS said malware was blocked and moved to the Trash. Am I safe?

It means XProtect recognised a known malicious file and removed it before it ran. Check where the file came from and run the checks above: the same site or email may have delivered something XProtect didn't recognise.

Is it safe to paste a command into Terminal?

Only when you typed the site's address yourself and you know what the line does. Never paste a line from an ad, a pop-up, a "verify you are human" page or a chat. If it pipes a download into sh or bash, decodes base64 or asks for your password, stop.

Do I need to erase my Mac?

If you can't identify and remove what you found, or the Mac held recovery phrases or keys worth a lot, erasing is the safe choice. Back up your documents, not your apps, and sign in again from scratch.