If you own an Apple computer, you need to be aware of an increasingly common scam going around that could allow a bad actor to gain control of your Mac. It’s known as the “copy-paste” scam, and it has been perpetrated so often that earlier this year, Apple added safeguards to help unsuspecting users avoid becoming victims. Here’s what you need to know about the Apple copy-paste scam, and how you can protect yourself against it.
What is the Apple copy-paste scam?
The Apple copy-paste scam is a tactic scammers use to trick you into granting them remote access to your Apple computer, whether it’s a MacBook, iMac, Mac mini, or Mac Studio.
At the heart of the scam is a specific command that a scammer gets you to copy and paste into the Terminal. Many Mac users would never have used the Terminal before being asked to do this. It’s an app geared primarily for power users that lets you control your Mac via text commands instead of clicking on buttons and other graphical user interface elements.
While Terminal is a powerful tool for advanced Mac users, using it without proper knowledge can cause unintended consequences for your Mac’s operation or its data. Worse, if specific Terminal commands are entered, they can install malware or grant people remote access to your Mac and all its data—and you’ll likely never even know it.
Such access could allow scammers to extract your personal files, including documents, emails, photos, financial data, contacts, and more. The Terminal command could also install software that logs your keystrokes, so a scammer knows every word you type in any app. The scammer could also remotely shut down your Mac and lock you out of its data until you agree to pay a ransom.
Like the “Apple High Alert” scam, the copy-paste scam doesn’t take advantage of any inherent weaknesses in your Mac’s security. Instead, it is a phishing endeavor that uses social engineering to trick you into entering specific Terminal commands, allowing the scammer to carry out their attack.
How does the Apple copy-paste scam work?
The maneuver is known as the “copy-paste” scam because its main attack vector is getting you to copy a nefarious Terminal command from one of many possible sources: an email or text the scammer sends you, an online forum comment they’ve left, a webpage they’ve set up that portrays the command as a valid troubleshooting step, or a chatbot that recommends the bad command through a method known as indirect prompt injection.