Fake Mac cleanup guides and Terminal scams: how to spot them

A fake Mac cleanup Terminal command has become a common way to infect Macs. A web page, a shared chatbot conversation or a copy of a real app's website promises to free up space, and asks you to paste one line into Terminal. That line downloads malware that steals passwords, browser data and cryptocurrency wallets.

The rule that catches almost all of them is simple: real storage cleanup on a Mac never needs you to paste anything into Terminal. Apple's own list of scams includes commands or scripts that a website, email or message tells you to paste into Terminal. Storage settings, Finder and each app's own settings do the job.

Fake cleaner apps and scareware pop-ups are the older version of the same trick. They show alarming scan results, then sell you a fix. A pop-up in your browser saying your Mac is infected is an ad, not a diagnosis.

If you've already run a command from a cleanup guide, act now: change your passwords from another device, check what runs at login, scan the Mac, and consider erasing it. The steps are below, after how these scams work and how to spot them.

How fake Mac cleanup guides work

Security researchers call attacks like this ClickFix, or ClickFix-style: instead of breaking into a Mac, it persuades the owner to run the malware themselves, as if it were a fix. Fake cleanup guides are one of its favourite disguises, because a full disk is a common, stressful problem.

Where do people find them?

Mostly through search. Someone types a question like how to clear disk space on a Mac, and the first results, sometimes paid ads, lead to a guide. Researchers have found these guides as shared chatbot conversations, as copies of a well-known cleaner's website, and as pages styled to look like Apple's.

The pages look helpful. They have numbered steps, friendly reassurance that nothing personal will be touched, and a single command presented as the safe, advanced way to clean up.

Why storage, of all things?

Because a full disk is common, urgent and confusing. Huntress points out that a search like how to clear disk space on macOS isn't a niche or suspicious phrase; it's exactly what an ordinary user types when storage runs out. System Data's vague label makes people look for help even more.

What does the command look like?

Usually one short line, often with a long block of letters and numbers in the middle. That block is encoded, so you can't read where it goes. Once pasted and run, the line quietly downloads a script from the attacker's server and runs it straight away.

Nothing seems to happen. There's no download in your Downloads folder, no disk image, no app to open. That's the point: it skips the steps where macOS would normally check what you're installing.

Why does it ask for your password?

Because your login password unlocks your Keychain, where macOS keeps saved passwords, Wi-Fi credentials and other secrets. In the fake CleanMyMac case Malwarebytes analysed in March 2026, the malware showed a dialog titled "System Preferences" with a padlock icon, and asked again, up to ten times, until it got a working password.

Its awkward wording was one clue it was fake. Another is timing: a password dialog that pops up right after you pasted a command isn't macOS checking on you.

What does it take?

The malware in these campaigns is an infostealer. Malwarebytes and Huntress describe it collecting saved passwords, cookies and autofill data from browsers, the Keychain, cryptocurrency wallets and their browser extensions, and other files of value, then sending them to the attacker.

Some go further. The SHub Stealer variant Malwarebytes found replaced parts of five wallet apps to capture recovery phrases, and installed a background task, disguised with a Google updater's name, that let attackers run commands on the Mac later.

Stage	What you see	What actually happens
Search	A top result or ad for a cleanup guide	Attackers paid for or pushed the result
Guide	Friendly steps and one command	The command hides an address in encoded text
Paste	Nothing much	A script downloads and runs
Password	A system-looking dialog	Your password unlocks your Keychain for the malware
Afterwards	Maybe an error saying the app didn't install	Your data is sent away; a background task stays

Three campaigns researchers have documented

These are published reports from security companies, with their dates. Each one used storage cleanup as the lure.

December 2025: poisoned ChatGPT and Grok conversations

Huntress published its report on 9 December 2025. A Mac user had searched for how to clear disk space on macOS, and two highly ranked results led to shared conversations on ChatGPT and on Grok, hosted on the real sites. Both gave polite troubleshooting steps and a Terminal command presented as safe system cleanup.

The user ran it. Huntress says the command installed a variant of Atomic macOS Stealer, known as AMOS, which harvested their password, gained root access, the highest level on a Mac, and set itself up to keep running. Huntress reproduced the same kind of results for searches such as how to free up storage on a Mac.

Why a shared chat is so convincing

Malwarebytes covered the same campaign on 12 December 2025 and explained why it works. A shared conversation lives on a trusted site, but its owner chooses what to share. Attackers can steer a chatbot into writing a cleanup guide around their command, then share only the polished result.

Malwarebytes' advice was blunt: don't click sponsored search results, check who the advertiser is if you do, and never run copy-pasted commands from pages or forums, even on sites that seem legitimate.

March 2026: a fake CleanMyMac website

On 6 March 2026, Malwarebytes described a website made to look like the CleanMyMac product page, unconnected to the real app or its developer, MacPaw. It offered an "advanced installation option": open Terminal, paste a command, press Return.

The command installed SHub Stealer, which took passwords, browser data, Keychain contents, cryptocurrency wallets and Telegram sessions. It ended by showing an error that the app wasn't supported, so the victim would think the install had simply failed.

April 2026: a fake Apple page that used Script Editor

On 8 April 2026, Jamf Threat Labs described an Apple-themed page that claimed to help reclaim disk space on your Mac. Instead of asking for a paste into Terminal, it had an Execute button. The browser asked to open Script Editor, which appeared with a script already filled in.

Running that script delivered a recent Atomic Stealer variant. Jamf notes that on recent versions of macOS Tahoe, Script Editor shows an extra warning first, asking you to save the script before it runs. That warning is a moment to stop.

What do these campaigns have in common?

Each one used storage cleanup as the reason, got the victim to run the code themselves, and went after passwords, browser data and wallets.

Malwarebytes places SHub in a family of Mac stealers that share the same pattern: a ClickFix-style lure, an AppleScript payload, a fake System Preferences password prompt and data sent off in a compressed archive.

The lure changes, from a chat to a fake product page to an Apple-styled guide. The request at its centre stays the same.

Reported	Lure	How it ran	Malware	By
9 Dec 2025	Shared ChatGPT and Grok chats in search results	Terminal paste	Atomic Stealer	Huntress
6 Mar 2026	A copy of the CleanMyMac website	Terminal paste	SHub Stealer	Malwarebytes
8 Apr 2026	An Apple-styled disk space guide	Script Editor	Atomic Stealer	Jamf

Why a fake Mac cleanup Terminal command gets past macOS

macOS checks apps carefully. A line you type or paste yourself is different, and that's the gap these scams use.

What does Gatekeeper check, and what doesn't it?

Apple's Gatekeeper checks apps, plug-ins and installer packages from outside the App Store: their developer's signature, and Apple's notarization, which means Apple scanned them for known malware. macOS also asks before you open downloaded software the first time.

A pasted command isn't a downloaded app, so none of that happens. Malwarebytes notes that once you paste and press Return, Gatekeeper, notarization and XProtect offer little protection, and Huntress points out that Gatekeeper doesn't inspect shell scripts or one-line commands.

Why do these guides seem trustworthy?

Because each layer looks familiar. Huntress lists them: you trust the search engine, the platform hosting the page, the format of a chatbot answer, and the idea that Terminal is a normal tool for maintenance. People do paste commands from forums and help sites every day.

None of those layers is broken. The attack uses all of them, which is why the content of the page is the only thing left to judge.

What does Terminal's new warning do?

Security researchers reported in March 2026 that macOS Tahoe 26.4 added a warning when you paste certain commands into Terminal. It reads "Possible malware, Paste blocked", says your Mac hasn't been harmed, and explains that scammers encourage pasting text into Terminal, often through websites, chat agents, apps, files or phone calls.

Apple didn't announce it in the release notes, and Moonlock reported in April 2026 that it doesn't appear for every command. Treat it as a last safety net. If you see it, don't choose to paste anyway: close the page that sent you there.

Does security software catch it?

Sometimes. Malwarebytes recommends real-time protection with a web protection component, and says its Mac app detects and removes the components of these stealers. XProtect's signatures update automatically, usually daily. Both are strongest against malware that's already known, so neither turns a pasted command from a stranger into a safe one.

Doesn't Terminal have real uses?

Yes, for developers and administrators who know what each command does. But Apple's own guides to freeing up storage don't use it: their steps go through System Settings, Finder, Disk Utility and apps' own settings. If a storage guide needs Terminal, it isn't written for you, and it may not be written for your benefit.

Fake cleaner apps and scareware pop-ups

Not every scam needs a command. Some are apps you install yourself, and some are web pages pretending to be your Mac.

What is a fake cleaner app?

Malwarebytes classes some so-called system optimizers as potentially unwanted programs. It says they use intentionally false positives to convince you your Mac has problems, then sell you software to remove them, and that people usually install them under false pretences.

It also has a category for programs that make false or exaggerated claims about removing threats from a Mac. Fake cleaning apps, it notes, can give a false sense of security.

How do you tell an honest tool from a scareware one?

An honest tool explains what it found and lets you decide. A scareware one leads with a large, frightening number and a countdown. Be wary of apps that call ordinary caches and logs dangerous, promise to speed up your Mac, or demand payment before showing what they'd remove.

The post on whether you need a cleaner app covers what macOS already does without one.

What about pop-ups that say your Mac is infected?

Apple says that pop-ups or alerts in your browser that warn about security problems or viruses are usually fraudulent ads, designed to trick you into downloading damaging software or handing over money or personal information. Don't call the number or follow the links. Close the tab or the whole window.

When macOS itself finds known malware, it's XProtect that blocks it, moves it to the Trash and tells you in its own alert. A web page can't scan your Mac.

How do you remove a fake cleaner app?

Quit it, then drag it from Applications to the Trash. Check System Settings › General › Login Items & Extensions for anything it added under Open at Login or App Background Activity, and turn it off. Malwarebytes says its Mac app detects and removes the components of the optimizers it flags, if you'd rather a scanner did the looking.

Fake copies of real apps

The fake CleanMyMac site shows a third kind: a copy of a real, well-known app's website. The name is right, the design is right, and the download step is wrong. Real apps arrive as an app, a disk image or an installer package, which macOS checks.

The post on disk images and installer packages explains what a normal download looks like on a Mac.

What it is	What it does	What to do
Fake cleanup guide	Asks you to paste a command	Close it; use Storage settings
Fake copy of a real app's site	Swaps the download for a command	Go to the developer's site yourself
System optimizer scareware	Shows false problems to sell a license	Don't buy; remove the app
Browser pop-up saying you're infected	An ad pretending to be an alert	Close the tab or window
Fake password dialog	Collects your login password	Never type it after pasting something

How to spot a fake cleanup guide

Most fake guides give themselves away in the first few lines. These are the signs, roughly in the order you'll meet them.

Does the page ask you to paste or run anything?

That's the clearest sign, and on its own it's enough. Copying a command into Terminal, running a script in Script Editor, or clicking a button that opens either one are all the same request. A guide to freeing up space doesn't need any of them.

Is part of the instruction unreadable?

A long run of random-looking letters, or a line that's mostly symbols, is text someone didn't want you to read. Encoding is how these commands hide the address they download from. If you can't read what a step does, don't do it.

Is it in a hurry?

Malwarebytes notes that sophisticated ClickFix pages add countdowns, counters of other users or other pressure to make you act quickly. Apple's scam guidance makes the same point about urgency. Real help doesn't expire in five minutes.

Did a password prompt appear out of nowhere?

macOS asks for your password when you install software, change a protected setting or unlock something you chose to open. A dialog that appears right after you pasted something, with odd wording or that keeps asking, isn't macOS. Huntress's advice is to be suspicious of any utility you don't fully understand that asks for your password.

Was it a sponsored result or a shared chat?

The December 2025 campaign started from top search results, and Malwarebytes found signs that the fake CleanMyMac site was reached through paid placements. It suggests skipping sponsored results, or checking the verified advertiser through the ad's menu first. A shared chatbot conversation is written by whoever shared it, not by the chatbot's company.

Does the address match the company?

Apple's list of phishing signs includes a link that looks right but whose address doesn't match the company's website. The fake CleanMyMac site used a lookalike address close to the product's name. Before you download anything, check that the address in the browser's address bar belongs to the developer, not to something that merely contains its name.

What if a person asks you to run it?

The text of Terminal's new warning mentions phone calls as well as websites and chats. Apple says scammers impersonate Apple Support and other trusted companies, and that if you get an unsolicited call claiming to be from Apple, you should just hang up. No genuine support agent needs you to paste a command they read out.

Does it tell you to switch off a protection?

Apple says it will never ask you to disable a security feature. A guide that tells you to override Gatekeeper's warning, open an app anyway, or turn off a setting in Privacy & Security to make its fix work is asking you to lower your guard.

Warning sign	Why it matters
Paste into Terminal, or run a script	It's how these guides install malware
An unreadable block of text	It hides where the command downloads from
A countdown or "act now"	Pressure stops you checking
A password prompt after pasting	It's after your Keychain
A sponsored result or a shared chat	Anyone can pay for an ad or share a chat
Instructions to turn off protections	Apple never asks you to

Safe ways to free up space and get software

The safe route is also the shorter one. Everything a fake guide promises, macOS can do through its own settings.

Where should you get Mac apps?

Apple says the safest place is the App Store, where Apple reviews and signs each app. Apps from a developer's own website are checked too: macOS verifies the developer's signature and requires apps to be notarized, which means Apple checked them for known malware and found none.

Type the developer's address yourself, or follow a link from a source you already trust, rather than an ad. Apple's tip for checking a link: hover over it and read the address in the status bar before you click.

What does real cleanup look like?

It happens in places you can see. Storage settings lists what's large; Finder moves what you choose to the Trash, where it waits until you empty it. Apps clear their own data in their own settings. The monthly storage routine covers it step by step, with no Terminal involved.

Which "cleanup" steps should you be wary of, even without Terminal?

Guides that tell you to delete whole Library folders, preferences or hidden system files do damage without any malware. App preferences are tiny settings files, not caches; the post on why preferences aren't clutter explains what clearing them really does.

Hidden files are hidden for a reason, and what's behind hidden files covers which ones matter and which are safe to leave alone.

Is it safe to ask a chatbot for help?

For an explanation, yes; for a command, be careful. A chatbot answering you directly isn't the same as a conversation someone else shared, but either can be wrong. Ask for steps in System Settings or Finder instead, and if an answer includes a Terminal command, don't paste it: freeing up space never needs one.

What if your Mac is really full right now?

Start with what gives space back fastest without any risk to the system: look through the Trash and empty it, sort Downloads by size, and check iOS Files in Storage settings for backups of devices you no longer have. Those three can free a lot of space, and none of them needs anything more than Finder and System Settings.

What should you do before any big cleanup?

Back up. A recent Time Machine backup means a mistake costs a restore, not your files. The post on backing up before a cleanup covers what to check first.

What to do if you already ran a command

If you pasted a command from a cleanup guide, a shared chat or a copy of an app's website, treat the Mac as compromised. These steps come from Malwarebytes', Huntress's and Apple's published advice.

What if you copied it but never ran it?

Then nothing happened. Malwarebytes' advice for anyone who hasn't run the command yet is to close the page and not go back. If Terminal's warning blocked the paste, nothing ran either; the warning itself says your Mac hasn't been harmed. Copy some ordinary text afterwards so the command isn't left on your clipboard.

Change your passwords, from another device

Malwarebytes says your Mac login password and any passwords stored in your browser or Keychain should be considered exposed, and should be changed from a device you trust. Start with the accounts that matter most, such as your email and your Apple Account, and turn on two-factor authentication for them.

For your Apple Account, Apple's steps are to change the password, make sure two-factor authentication is on, and remove any devices you don't recognize at account.apple.com. Huntress suggests strong, random passwords kept in a password manager.

Treat wallets and developer keys as exposed

If you have cryptocurrency wallets on the Mac, Malwarebytes advises assuming the recovery phrase and wallet password are known to the attacker, and moving funds to a new wallet created on a clean device. A recovery phrase can't be changed.

If you're a developer, revoke and replace API keys, SSH keys and tokens the Mac held. The SHub Stealer copied shell history and Git settings, where keys are often found.

Look for what it left running

Open Apple menu › System Settings, click General, then Login Items & Extensions. Look under Open at Login and App Background Activity for anything you don't recognize, and remove or turn it off.

Malwarebytes also suggests checking the LaunchAgents folder in your Library for items you didn't install. In Finder, choose Go › Go to Folder and enter ~/Library/LaunchAgents. The SHub Stealer hid there under a name made to look like Google's updater, so a familiar name doesn't prove an item is genuine.

Why can't you see everything it installed?

Some of it is hidden. Huntress notes that a file whose name starts with a period is hidden from Finder's normal view, and that malware uses this to stay out of sight. That's one reason a scan by security software, or help from someone you trust, is more reliable than looking by hand.

Scan, then consider erasing

Malwarebytes suggests scanning with reputable security software, and if signs of a backdoor or unusual activity remain, a full clean reinstall of macOS. It warns against restoring from backups that may contain the malware, and suggests checking browser extensions afterwards.

To erase a Mac with Apple silicon or the T2 chip, Apple's route is System Settings › General › Transfer or Reset › Erase All Content and Settings. It removes your data, settings and apps, so restore your files only from a backup you know is clean.

Should you report it?

If the guide came by email and looked like it was from Apple, Apple asks you to forward it to reportphishing@apple.com. In the US, Apple also points to the Federal Trade Commission's reportfraud.ftc.gov for scam phone calls.

Who can help?

If you're not sure what you're looking at, ask someone you trust or a security company's support team for help before you use the Mac for anything sensitive. For your Apple Account or an Apple device, contact Apple directly through its official support channels, as Apple's scam guidance recommends.

Step	Why	From
Change passwords from another device	The Mac's saved passwords may be stolen	Malwarebytes
Secure your Apple Account	Two-factor authentication, remove unknown devices	Apple
Move crypto to a new wallet	Recovery phrases can't be changed	Malwarebytes
Revoke developer keys	Shell history can hold them	Malwarebytes
Check login items and LaunchAgents	Malware sets itself to run again	Malwarebytes
Scan, then consider erasing	Hidden parts can stay behind	Malwarebytes

A worked example: reading a fake guide

Here's how the signs line up on a typical fake guide, the kind researchers describe, so you can recognize one in the wild.

The search

Your Mac says its startup disk is almost full. You search for how to clear System Data on a Mac. The first result is marked as sponsored and leads to a shared chatbot conversation titled something like a safe guide to clearing storage.

Two signs already: a sponsored result, and a conversation someone else chose to share.

The page

The answer is friendly and well formatted. It says the cleanup is safe, won't touch your personal files and takes a minute. Step 1 is to open Terminal. Step 2 is a single line to copy, with a long encoded section in the middle.

That's the third and fourth sign: a paste into Terminal, and a step you can't read. You can stop here.

What would have happened next

If you'd pasted it, nothing visible would happen until a password dialog appeared, with slightly odd wording. Typing your password would unlock your Keychain for the malware. A while later, you might see an error, or nothing at all.

The safe version of the same task

Choose Apple menu › System Settings › General › Storage and see what's actually large. For System Data, the guide to clearing System Data safely goes through what's inside it and what macOS manages by itself. No step involves Terminal, and nothing is deleted that you didn't choose.

How the app does it

Wombit never asks you to paste anything into Terminal. It's a native Mac app that shows what's using your storage, explains every item in plain language, and clears it safely: Trash first, undoable and logged. It reads only names, sizes and dates, and file names and paths never leave your Mac.

Explanations come from a catalog written and checked by hand, with sources. Only items rated Safe start checked; anything that may be your only copy waits for your choice. Items no catalog entry explains are never offered for removal.

For those, the app can write a Best guess on your Mac with Apple Intelligence, labelled as a guess. Before it's shown, the app takes out any sentence that contains a Terminal command, advises deleting, or gives a verdict such as safe to remove.

When a tool such as npm or Docker has its own cleanup command, the app runs that command itself after a review sheet that lists it and says what can't be put back. Nothing runs until you click the sheet's button. Updates install only if they're signed with the app's own key.

The analyzer, the map, the explanations, Undo, Put Back and Empty Trash are free. Cleanup and the uninstaller are PRO: one payment of $4.99 with lifetime access. Every Pro tool's review is free to open, so you see what would go and why before you buy.