Post #3522803

I was trying to carve out an encrypted blob from a PNG file last night using dd and finally triggered the new macOS ClickFix warning in my terminal. It was interesting that it fired because I wasn’t attempting to execute a commonly abused binary like osascript or make an outbound web call. While I haven’t been able to identify what XProtect is flagging on, I’m personally leaning towards either simple pattern matching for risky terms (I did have a suspicious output filename) or literally any pastes from a browser. The latter I have tried numerous times to no avail when this was first released in Tahoe 26.4, so I have no idea. FWIW, this was the offending command: dd if=clik.txt of=encrypted_payload.bin bs=1 skip=27856 status=progress https://9to5mac.com/2026/03/25/macos-26-4-has-new-terminal-popup-warning-when-pasting-commands/ #macos #malware #clickfix