Victim triage · macOS
I pasted a command into Terminal. What now?
Written by Antonio Radu. Something wrong or out of date? corrections@clickfixreport.com
The line that page told you to paste into Terminal ran as a command under your own account. Work down this list in order — the explanation is below it and can wait.
Do this now
~15 MINUTES
Disconnect from the network. Do not shut the Mac down.
Turn Wi-Fi off on this Mac from the menu bar, or unplug its Ethernet cable or adapter.
Do not switch off your router. You need the internet on a different device for almost everything below, and turning off the router disconnects that device too.
A stealer finishes in seconds, so what it took has probably already left and disconnecting will not undo that. Do it anyway: it stops a second stage being fetched and cuts off remote control. Do not shut down — a background item comes back at login, and powering off erases what is in memory, the only place a professional could still read exactly what ran.
Leave the Terminal window open. Scrolling up in it shows the line you pasted, which is worth having if somebody is helping you — but do not press the up arrow and Return, which would run it again.
Move to a different device for everything below.
Your phone, a tablet, or another computer. Do not change passwords on the machine you pasted on — anything still running there reads the new ones as you type them.
On your email account, sign out of every session — before you touch the password.
Stealers take session cookies first: the token your browser holds that says “this person already logged in”. Whoever has a copy opens your account without the password and without being asked for your second factor.
Changing the password does not log the attacker out — the stolen cookie keeps their session alive until you revoke it. You can change the password twenty times and they will still be reading your mail. In your account’s security settings, find the wording for it — “sign out of all devices”, “log out everywhere”, “active sessions” — and use it. Email first: it is the reset path to everything else you own.
Now change the email password.
With the old sessions dead, a new password does what you expect: it stops the attacker signing back in with the credentials they already hold. In the other order it buys almost nothing. Use one you have never used anywhere else, set from the clean device.
Re-enrol multi-factor authentication, and remove what was added.
A second factor the attacker controls is worse than none. Re-enrol yours where you have any doubt, and remove what you do not recognise: extra authenticator apps, keys or passkeys; a recovery address or phone number that is not yours; mail rules that forward or delete messages, so you never see the reset alerts; third-party apps with access.
Only now, work through your other accounts.
Your Apple Account first — it controls iCloud data, Find My, device trust and purchases. Remove every device and session you do not recognise, change the password, then check the trusted phone numbers and any app-specific passwords.
Same three moves each time, in the same order: revoke, change, check. Anything holding money first, then work accounts, then every site where you reused that password. Give each its own password from a password manager on a clean device — and if you had one on the machine you pasted on, read the second bullet under What the attacker probably took first.
Change the Mac's own login password.
On the Mac itself, after the steps above — System Settings → Touch ID & Password. This re-locks the login keychain, which closes the door going forward. It does not un-steal what was already read out of it, so those saved passwords still need changing at the sites themselves.
If this is a work, school or shared Mac, report it now.
Tell your IT or security team before you clean anything. They may want it exactly as it is, and they can check whether the same page reached anyone else.
Steps 1 to 4 carry most of the protection and need no technical skill.
What the attacker probably took
The pasted line is almost always a downloader, and in the campaigns reported publicly what it fetches is nearly always a stealer from the AMOS / Atomic family. Gatekeeper did not stop it because Gatekeeper applies to apps you download and open in Finder, not to a command you run yourself. Assume the following are gone:
- Login keychain contents, if your password was entered — saved website and Wi-Fi passwords, certificates and tokens. Items synced through iCloud Keychain are a separate store, held by the system rather than in the login keychain file, and are not exposed in the same way. Do not read that as safety: your browser profiles — saved passwords, cookies, autofill and history — are gone regardless.
- Your password manager, if it was unlocked. Stealers look for the vault file on disk and for the browser extension in an unlocked state. If either was true, treat every credential in that vault as exposed — not only the ones you used that day — and change the master password from a clean device before you use it to set new ones.
- Cryptocurrency wallets — extensions, desktop wallet data, and anything resembling a seed phrase or private key. If a seed phrase was ever on that Mac, treat it as public.
- Notes, documents and messaging tokens. The Apple Notes database is a routine target, as are small files in Desktop, Documents and Downloads.
What to check on the Mac
Still disconnected. Look for items dated around the time it happened, named randomly or imitating a real product. If you closed the Terminal window before reading it, the shell writes its history to ~/.zsh_history — though only on close, so a session you never closed may not be there.
- Background items and launch agents. System Settings → General → Login Items & Extensions, including “Allow in the Background”, which names the developer behind each entry. The underlying files are in
~/Library/LaunchAgentsand/Library/LaunchDaemons; a.plistcreated that day is the classic artefact for this attack. - Privacy permissions. System Settings → Privacy & Security, then Accessibility, Automation, Full Disk Access and Screen Recording. Remove anything you did not grant deliberately — these turn a stealer into a watcher.
- Configuration profiles. System Settings → General → VPN & Device Management. On a personal Mac there should be nothing here, and a profile you did not install means you should reinstall.
XProtect, the built-in scanner, cannot be run on demand and will not recognise a build a few hours old. For an on-demand look, Malwarebytes offers a free scan and Objective-See’s KnockKnock lists everything installed to launch persistently. Treat a clean result as weak evidence, and do not accept help from anyone who contacts you first — fake cleanup services are a routine second wave.
Decide whether you can keep using it
Once an unknown program has run under your account, erasing the Mac is the only way to be certain; everything else is a probability judgement. Erase and reinstall if it held work data, source code, crypto keys or customer information — or if you typed your Mac password into a prompt, or found a launch agent, background item, configuration profile or privacy permission you did not create. Scan, watch and carry on if it is a spare machine with nothing valuable on it and the checks above came back clean.
If you do erase: System Settings → General → Transfer or Reset → Erase All Content and Settings on Apple silicon or a T2 Mac; on older hardware, erase the disk in Disk Utility from macOS Recovery. Copy out documents and photos only, and do not restore a Time Machine backup made after the incident. Set the new passwords before signing back into anything.
Over the next few days
- Watch for reset messages and sign-in alerts you did not trigger, and re-check your mail rules — attackers often add a forwarding rule again once the panic has passed.
- Read bank and card statements line by line; test charges of a pound come before the real ones. If money has already moved, call the fraud line now — they can sometimes stop a payment that is hours old.
- If a seed phrase or wallet file was ever on that machine, move the funds to a wallet created on a clean device. A stolen seed phrase does not expire.
- Anyone else who uses it needs the same three moves. Report it, too: the reference number is what banks and insurers ask for.
Nothing on this page asks you to run a command, download a fix, or paste anything into a terminal — and it never will. Any site that offers to solve this for you and then tells you to paste a command is the same attack a second time.