title: 'T1204.004 Malicious Copy and Paste — ClickFix macOS Terminal Execution'
id: '67bdcacb-65fe-5de6-a9a5-60d30ddeda59'
status: 'experimental'
description: 'Shell spawned by Terminal.app (or another macOS terminal emulator) running a pipe-to-shell or base64-decode-to-shell one-liner, which is the macOS branch of a ClickFix lure. The counterfeit reCAPTCHA instructs the victim to open Terminal from Applications -> Utilities, press Command+V against a clipboard the page has already poisoned, and press Enter. Observed 2026-08-11 as the macOS half of an EtherHiding campaign that branched on navigator.userAgent and served a separate on-chain payload to Macintosh visitors. The macOS variant of that campaign also randomized its injected CSS class names where the Windows variant used static ones, which suggests it is the more actively maintained build and argues for treating macOS coverage as equal priority rather than as a follow-up. Detection anchors on the terminal-emulator parent plus remote-fetch-into-interpreter argument shape; a bare curl or bash under Terminal is normal developer behavior and is deliberately not matched on its own.'
references:
    - 'https://thrunt.me/sigma/t1204-004-clickfix-macos-terminal-execution.yml'
    - 'https://attack.mitre.org/techniques/T1204/004/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-08-11'
modified: '2026-08-11'
tags:
    - 'attack.execution'
    - 'attack.t1204.004'
    - 'tlp.clear'
logsource:
    category: 'process_creation'
    product: 'macos'
detection:
    selection_terminal_parent:
        ParentImage|endswith:
            - '/Terminal'
            - '/iTerm2'
            - '/kitty'
            - '/alacritty'
            - '/WezTerm'
    selection_interpreter:
        Image|endswith:
            - '/bash'
            - '/sh'
            - '/zsh'
            - '/osascript'
            - '/python3'
    selection_remote_exec:
        CommandLine|contains:
            - 'curl -'
            - 'wget '
            - 'base64 -d'
            - 'base64 --decode'
            - 'eval "$('
            - '| sh'
            - '| bash'
            - '| zsh'
            - 'osascript -e'
    condition: 'selection_terminal_parent and selection_interpreter and selection_remote_exec'
falsepositives:
    - 'Developers installing tooling via documented curl-pipe-shell instructions (Homebrew, rustup, nvm and similar). This is the dominant false positive on engineering endpoints — baseline the common installer URLs and allowlist them by command text rather than dropping the remote-exec selection.'
    - 'Provisioning and dotfile bootstrap scripts run interactively on first login.'
    - 'Security tooling and CI runners that shell out under a terminal emulator.'
level: 'high'