No real website asks you to paste a command to prove you're human.
That single rule will protect your office from one of the fastest-growing scams aimed at Mac users right now. The setup looks harmless — a page tells you to copy a little something and paste it into your Mac to "verify" you're a person or to "free up disk space." The moment you do, you have installed the malware yourself.
The real thing you should know about
The technique has a name: ClickFix. The anchor is simple: ClickFix tricks Mac users into pasting a malicious command into Terminal or Script Editor, and that command quietly installs a password-stealing program. It has climbed to become one of the top ways attackers get their software onto a machine, because it skips every technical defense and goes straight for the person at the keyboard.
Here is the shape of it, without any of the dangerous specifics. You land on a page — maybe through a search ad, a hijacked website, a fake "your Mac is low on storage" pop-up, or a phony video site. The page shows what looks like a normal verification step: a fake CAPTCHA, a "reclaim disk space" button, or an "error — run this to fix" message. It then walks you through copying some text and pasting it into a Mac app. People follow along because the instructions feel official and the page looks polished. When the command runs, it pulls down and installs an infostealer — often the Atomic Stealer, also called AMOS — which then goes hunting for your saved passwords, browser logins, and anything else of value on the machine.
The clever, nasty part is how it adapts. Apple recently added a warning when certain risky commands get pasted into Terminal. The scammers simply changed lanes: many of these lures now steer victims into Script Editor instead, which does not throw the same warning. So a protection that should have helped gets sidestepped, and the average person has no idea Script Editor is even capable of doing harm.
Why a small firm should actually care
You might assume only careless people fall for this. The opposite is true. The victims are usually competent, busy professionals who were trying to do the right thing — fix an error, pass a verification, get back to work. The scam works precisely because it borrows the look of routine tech support and asks for one small, reasonable-seeming action.
For a small business, the blast radius is large. The person most likely to be doing five things at once — searching for a quick fix, downloading a tool, clearing space on a laptop — is often the office manager or owner, the very person whose Mac holds the logins that run everything. One pasted command can hand over the email account, the cloud file storage, the practice-management or accounting software, and saved browser passwords in one shot.
For healthcare and dental offices, that exposure can reach patient records, which turns an annoying malware cleanup into a reportable breach with notification duties and regulatory attention. And because the stolen item is often a live login or session, the attacker may not need to "hack" anything else — they can simply walk in using your credentials. There is no firewall setting that fixes a problem you invited in by hand, which is exactly why this vector has gotten so popular with criminals.