Apple copy-paste – Scammers are pushing Apple Mac users to copy and paste dangerous Terminal commands, sometimes to seize remote control, steal personal files, or lock victims out of their data. Apple added protections in macOS 26.4 this spring, showing “Possible malware, paste
For many Mac owners, the danger starts with something that feels harmless: a line of text.
A message arrives—an email. a text. or even a phone call disguised as “tech support.” The sender tells the recipient to open Terminal. paste a command. and follow a few more steps in quick succession. The instruction may appear to be a fix for a problem. But if the command is the wrong one. it can give a scammer remote access to the Mac. letting them pull sensitive files or even take actions like shutting the computer down and locking the data behind a ransom demand.
Apple has been battling this kind of trick for months. Earlier this year. safeguards were added to help protect users from a scam now widely referred to as the “copy-paste” scam—an attack that doesn’t rely on a weakness in Apple’s security so much as it relies on social engineering: getting people to type specific Terminal commands they don’t understand.
At the heart of the scam is Terminal itself. The command scammers push is copied and pasted into the Terminal app on Macs—MacBook. iMac. Mac mini. or Mac Studio—and Terminal is central because it’s geared primarily for power users. It lets people control a Mac using text commands instead of clicking through the graphical interface.
Using Terminal without proper knowledge can have unintended consequences. In this scam, it can go further. Certain Terminal commands can install malware, grant remote access, and expose a victim’s data and privacy. With remote access, scammers could extract personal files, including documents, emails, photos, financial data, and contacts. The attack can also include software that logs keystrokes, allowing criminals to capture what a victim types across apps. And when a victim’s Mac is targeted for a more coercive outcome. it may be remotely shut down and locked so the user can’t access their data until they agree to pay a ransom.
The “copy-paste” part isn’t a slogan—it describes the method. Scammers obtain the harmful Terminal command from wherever they can get victims to copy it. That could be a message sent directly to a target. a comment posted in an online forum. a webpage designed to present the command as a valid troubleshooting step. or even a chatbot recommendation delivered through indirect prompt injection.
Sometimes the instructions come in person. In phone calls disguised as tech support, the scammer may have a live voice instruct the victim to type the command letter by letter, turning the setup into something that feels more “technical” and less like a trap.
In most cases. the scam’s instructions start the same way: open Terminal app from the Utilities folder inside the Applications folder. Then the scammer tells the user to copy-paste or manually enter one or more specific Terminal commands in succession. claiming it will secure the Mac or fix an issue. The reality is that the commands either grant remote access to the attacker or allow the extraction of sensitive data.
The most obvious sign a victim is being targeted is also the simplest: pressure and credentials that don’t hold up. Until recently. the only way many people could tell they were targets was by recognizing Terminal in the first place and understanding how Terminal commands could install malicious software or enable remote access.
The big tip-off, according to how these scams typically unfold, is receiving emails, text messages, or phone calls—allegedly from a “tech support” company or even purported Apple employees—pushing the recipient to copy-paste or manually enter specific commands into Terminal.
But there are cases where the danger doesn’t come with a message at all. If someone finds the nefarious command in a troubleshooting forum, or gets it suggested by a chatbot that surfaced it from its training data, there may be no immediate warning that the command could leave their Mac vulnerable.
That’s part of why Apple’s newer protections matter. With the release of macOS 26.4 this spring, Apple added safeguards against the copy-paste scam.
Now, if a user tries to paste a command from a website, chatbot, or messaging or email app—and the user isn’t a regular Terminal user—the Terminal app will show a “Possible malware, paste blocked” alert. The alert warns that the command could harm the Mac or compromise privacy.
The prompt gives the user a choice: it offers an option to paste the command into Terminal or not. The goal is to slow the person down and make them think before acting.
If the Terminal detects malware, it will automatically block the attempt and display one of two notifications: “Malware detected, paste blocked” or “Malicious script blocked.”
The simplest way to respond to this threat is also the hardest when someone is trying to rush you. The best protection is to never enter a command into Terminal until the user has personally verified what it will do. If someone isn’t 100% certain that a Terminal command won’t compromise the Mac or its data. Apple’s guidance is straightforward: never enter it—no matter who is pressuring you.
Scammers often rely on speed. If someone pushes a victim to quickly enter the Terminal command, claiming time is of the essence, the pressure tactic should be treated as a warning. False urgency is one of the tools used to keep people from thinking.
Blind trust is another opening scammers exploit. A command isn’t automatically safe because it appears on a Mac or tech forum. or because it shows up in a post on Reddit. Scammers know that leaving harmful commands on popular sites can cause some people—especially those actively searching for fixes—to copy and paste them without realizing what they’re doing.
Chatbots can also be a trap. The fact that ChatGPT or Google’s Gemini recommends a command doesn’t mean it’s safe. because chatbots sweep up information in their training data. including incorrect and even nefarious content. Scammers can place harmful commands online precisely so a chatbot might recommend them to someone looking for help.
And if the Terminal app ever displays the “Possible malware, paste blocked” notification, the recommended move is to decline to continue pasting unless the user is certain the command will not harm the Mac.
In a scam designed around text entry, the difference between a routine task and a takeover can come down to one moment: when the copy-paste instruction is offered, and whether the person slows down long enough to verify what the command is actually doing.
Apple macOS 26.4 copy-paste scam Terminal Mac security phishing remote access malware keystroke logging ransom