In macOS Tahoe 26.4, Apple has implemented a security measure that prevents the pasting and running of potentially dangerous commands in the Terminal, while also notifying users about possible threats.

This new feature seems designed to primarily combat ClickFix attacks and has been observed by macOS users since the operating system’s pre-release version. Apple did not explicitly mention this feature in the macOS Tahoe 26.4 release notes.

ClickFix is a social engineering tactic where users are tricked into pasting malicious commands into the command line, ostensibly to resolve an issue or complete a security check.

Because the user is pasting the command, typical security protocols are bypassed, allowing malware to infect the system.

To safeguard users from such attacks, Apple’s newest macOS delays the execution of a potentially harmful command pasted into the Terminal and displays a warning about the potential risks.

The warning informs the user that the system is unharmed because the command was stopped, and it explains that scammers often distribute malicious instructions through various sources.

Users have the option to refrain from pasting the command if they don’t understand its purpose and recognize that the instructions originated from an unreliable source. They can also disregard the warning and proceed, but this is only advised if they fully understand the command’s consequences.

Apple hasn’t published any official documentation for this new warning. According to user accounts, the system shows an alert when users copy commands from Safari and paste them into the Terminal.

One user suggested that these warnings only appear once per session, after testing several risky commands without triggering another alert. Another speculated that some form of analysis might be in place, as pasting harmless commands didn’t produce a warning.

BleepingComputer has reached out to Apple for more details and will update this article upon receiving a response.

To protect against ClickFix attacks, users of all operating systems are advised not to run commands found online unless they fully comprehend their function.

Additionally, macOS users should not depend completely on Apple’s new warnings, as it remains unclear how the system assesses the risk level of a pasted command to trigger an alert.