An interactive zsh session is a user-driven command shell on macOS, usually started in Terminal or another shell-capable app. Because it is launched by a real user and accepts typed commands, it can look like routine activity even when it becomes the first step in a malicious chain. Attackers often rely on this trust to blend into normal administration or developer workflows.
In cyber security, the term matters because many macOS attacks begin inside a shell rather than through a visible exploit. Defenders can use process lineage, command-line auditing, and endpoint telemetry to spot suspicious sequences such as an interactive shell spawning network tools, fetching payloads, or touching sensitive stores. A shell session that quickly pivots from normal use to downloads, staging, or credential access is often a stronger signal than a bad domain alone.