macOS Terminal is Apple’s built-in command-line interface for running shell commands and scripts on Mac computers. It is a powerful administrative tool: a single pasted command can start programs, download files, change settings, or launch follow-on scripts. Because Terminal executes text as instructions, it becomes a high-value target in social engineering campaigns.
In attacks, Terminal often appears as the final step of a ClickFix-style lure. A user is persuaded to copy and paste a command from a fake download or support page, turning the victim into the execution mechanism. This matters because file-based defenses may not see a malicious attachment; instead, the endpoint sees a legitimate shell session initiated by the user. Defenders should watch for suspicious one-line commands, unusual process trees, and pages that instruct manual command execution, especially when they arrive through search ads or other lookalike sites.