macOS 26.4 Introduces New Security Feature for Terminal Commands

[Superhai]

Apple should have made it pop up to everyone however. What about those who have already been scammed once?

I feel like that could have been the initial intention, but settled on the notion that if you have used the Terminal, you know what you are doing. Or maybe it is simply a bug.

 

[chown33]

If the alert is only presented for the first paste into Terminal, then creating a new local Mac account, logging into it, and pasting a safe command like 'id' should elicit the alert.

Also, does the alert appear if text is drag-and-dropped onto a Terminal window?

I don't have anything running Tahoe, so can't try these.

 

[Superhai]

Also, does the alert appear if text is drag-and-dropped onto a Terminal window?

Yes, any text dragged into it will make it appear. Even dragging an image. However if it comes from another Terminal window it is fine.

 

[bogdanw]

I don't understand, I'm pasting actual malware and get no warning. This is a new user account, Terminal started for the first time, macOS 26.4.

 

[IvyKing]

One reason why people can be passionate about the terminal apps - the shells (command line interpreters) have a fairly powerful programming language built in. There is a learning curve in understanding how the shells process commands, what regular expressions are and how they are processed, pipes and UNIX/BSD utilities. Having metioned that, one doesn't need to know all the details of shells and utilities to do useful work. Best way to learn is to start small and go from there.

 

[bogdanw]

What's the terminal command to turn this "protection" OFF ...?

"this protection is only activated if SIP is enabled" https://objective-see.org/blog/blog_0x87.html

 

[bogdanw]

Malware developers have already adapted to bypass it.
"New macOS stealer campaign uses Script Editor in ClickFix attack"
https://www.bleepingcomputer.com/ne...mpaign-uses-script-editor-in-clickfix-attack/
"These pages contain legitimate-looking system cleanup instructions but use the applescript:// URL scheme to launch Script Editor with a pre-filled executable code.
The malicious code runs an obfuscated ‘curl | zsh’ command, which downloads and executes a script directly in system memory."
"ClickFix technique uses Script Editor instead of Terminal on macOS"
https://www.jamf.com/blog/clickfix-macos-script-editor-atomic-stealer/

 

[losthismarbles]

Dedicated to everyone finding so much to disagree with me as regards my previous post and/or in the subject of handholding.

Read our newest please:

ClickFix malware authors already bypassing Apple's new Terminal paste warnings - 9to5Mac

9to5Mac Security Bite is exclusively brought to you by Mosyle, the only Apple Unified Platform. Making Apple devices work-ready and enterprise-safe is...

9to5mac.com

As i said back then, you can't fix stupid.
You can restrict and restrict some more, put us all in a corner, but stupid is as stupid does.. end of the day, the rest of us pay the consequences and PEBKAC will still happen.

Hardly meritocractic i'd think 🙂

Maybe we should introduce another warning? This time one that pops every time we click on something in the browser? Just to be safe man.