Paste-and-run is a social-engineering tactic that tricks a user into pasting a malicious command into a terminal or shell and then pressing Enter. Because the command is typed by the victim, the operating system treats it as intentional execution rather than as a suspicious download or attachment.
This matters because it can bypass controls that focus on files, signatures, or app permissions. On macOS and similar systems, attackers may use fake setup instructions, support prompts, or copied code blocks to convince people to run a command that fetches malware, changes browser settings, steals credentials, or installs persistence. Defenses include user training, careful review of any pasted shell command, monitoring for unusual terminal activity, and restricting administrative privileges. In practice, paste-and-run attacks succeed by shifting the trust decision from software security to human judgment.