New macOS feature seeks to avert ClickFix compromise

Apple has released a new mechanism for macOS Tahoe 26.4 that stops the execution of potentially harmful commands in Terminal and warns the user about related dangers, explaining how attackers often use different channels to distribute malicious instructions, reports BleepingComputer.

While it was not referenced alongside the release of the safety feature, the mechanism appears to focus on preventing ClickFix attacks, a social engineering technique that leads unsuspecting users to enter harmful commands under the guise of verifying a process or resolving an issue. When users paste a command, they receive an alert that the system has not been damaged and are given a choice to not proceed if the command comes from an untrusted source or to continue the action.

Apple did not disclose how the system determines the danger of the command to trigger the feature. Users are advised to refrain from executing commands that they do not understand to prevent incidents.