An obfuscated command is a shell or system command deliberately written to be harder for a person or security tool to read. Attackers may hide dangerous flags, split strings, use encoding, insert unnecessary characters, or chain simple commands so the real action is not obvious at first glance. The goal is often to bypass casual review and reduce the chance that a user notices malicious behavior before running it.
This matters because command obfuscation is a common step in social engineering, malware delivery, and supply-chain abuse. In AI-assisted workflows, an attacker can place an obfuscated command inside a seemingly helpful instruction, making a user copy it into a terminal. Defenders look for this by requiring provenance checks, reviewing any command that includes encoding or unusual punctuation, and using sandboxed execution or policy controls to block risky shell access. Careful inspection of commands is a simple but important defense against hidden execution.