Shopping for political merch shouldn’t require opening Terminal, but that’s exactly what some Mac users encountered while browsing BasedApparel.com. The site intermittently displays convincing fake Cloudflare “Unusual Web Traffic Detected” pages that trick visitors into running malicious commands. Think of it as the cybersecurity equivalent of a Trojan horse—except instead of wooden warriors, attackers hide credential-stealing scripts inside what looks like routine website security.
Terminal Commands Hide Credential Theft
The ClickFix technique exploits Mac users’ trust in familiar verification processes.
Here’s how the scam works: you click “Copy” on what appears to be an innocuous verification string, but the hidden clipboard content contains a base64-encoded shell command. When you paste it into Terminal, the script downloads an AppleScript-based infostealer that targets your browser passwords and cryptocurrency wallets.
Security researcher “debbie” described the payload to PCMag as “a classic infostealer, wrapped twice in base64″—essentially malware wearing multiple disguises.
Mac Security Myths Meet Reality
Rising threats like ShadowVault and this BasedApparel attack challenge the “Macs don’t get viruses” assumption.
Twenty-seven antivirus engines flagged the BasedApparel payload as malicious, joining a growing list of Mac-targeted threats including ShadowVault, which criminals rent for $500 monthly. The site appears compromised rather than intentionally malicious—a common ClickFix pattern where attackers abuse legitimate websites to deliver malware.
This technique has previously compromised WordPress sites and other platforms, making any website a potential threat vector.
Apple Fights Back With Paste Warnings
macOS now warns users about potentially dangerous pasted commands, but social engineering still works.
Apple’s recent macOS updates include safeguards that alert you when pasting web-copied commands into Terminal. However, these warnings only work if you actually heed them rather than trusting the fake Cloudflare page.
Your best defense remains skepticism:
- Legitimate verification pages never require Terminal access
- Keep macOS updated
- Use reputable antivirus software
- Remember that if a website asks you to run commands, you’re probably being scammed
