This threat involves a malicious website that instructs MacOS users to run a terminal command which decodes a Base64-encoded URL, downloads a shell script via curl, and executes it with zsh. The script collects system and network data, sends telemetry to a remote server, and executes a secondary AppleScript payload via osascript without user awareness. The attack was reported on Reddit with anecdotal evidence of account compromise following execution. There is no indication of a software vulnerability being exploited; rather, it is a user-targeted social engineering attack relying on command execution.

Execution of the downloaded script can lead to unauthorized data collection (system, locale, IP), telemetry exfiltration, and execution of additional malicious payloads on the victim's MacOS system. The reported consequence includes compromise of online accounts (e.g., Instagram) and potential for further malicious activity such as spreading scams. The attack requires user interaction to run the terminal command, limiting automatic exploitation.

No official patch or vendor advisory is available. Users should avoid running untrusted terminal commands from unknown or suspicious websites. Security awareness training to recognize social engineering attempts involving command execution is recommended. Since this is not a software vulnerability, traditional patching does not apply. Monitoring for unusual account activity and changing credentials after suspected compromise is advised.