You visit a website and it says it needs to check that you're human. Instead of clicking pictures of traffic lights, sidewalks or motorcycles, it tells you to copy a line of text, open Terminal and paste it in. Don't. That's the whole trick, and it's called ClickFix.
It's not a rare one. In September, hackers took over HBO Max's Reddit ad account and ran hundreds of fake ads that led to a copy of the HBO Max login page with exactly this lure. It targets Macs and Windows PCs alike.
Why it works
No computer or browser vulnerabilities are exploited here. They're relying on you to run the command yourself, and since you did, Apple's protections and most antivirus programs don't see anything wrong. The command installs software that steals saved passwords, logged-in accounts and cryptocurrency wallets.
Should you worry?
Only if you paste. A real website never needs you to open Terminal to prove you're a person. Treat it as an instant red flag, however polished the page looks.
Apple helps, too. Since macOS Tahoe 26.4, pasting a risky command into Terminal can bring up a warning that says "Possible malware, Paste blocked." If you see it, believe it and stop. Apple's stricter alerts, such as "Malware Detected, Paste Blocked," don't even offer a Paste Anyway button.
If you already pasted it
- Unplug any Ethernet cable and turn off Wi-Fi so nothing more gets sent out.
- Using a different device, change your Apple Account, email and banking passwords.
- Get the Mac checked before you trust it again.
Keep your Mac current while you're at it: Apple menu > System Settings > General > Software Update.
For offices: tell your staff about this one in plain words: "No website will ever ask you to paste something into Terminal." It takes ten seconds and could save you a bad week.