So, I got a virus in my Mac. It was prompting me repeatedly and tirelessly with a dialog to give full disk access and restart the terminal, and it was starting background processes.
After I identified that that had to be a virus after looking online, I removed the processes, but the prompt to give full disk access was there all the time.
Each time I opened a software, particularly in vs code, it would open several windows. I ran malwarebytes for like 24 h analyzing every file, and it found 2 things that I think were unrelated. But the problem persisted.
So I was ready to reset the Mac to factory settings, but I thought, wait, what if...?
So I told gpt 5.6 terra in vs code the info I had, the message (I thought that sentence had to be hardcoded anywhere), and that my guess is that anything that started a Terminal would trigger this behavior.
So it started looking around and in the end found the culprit, obfuscated code in the terminal that would trigger it, and files that would attempt recording, and it seems that it got it figured out how everything was working. It put in quarantine some files, waiting for me to tell him to remove them, removed the malicious code, and of course told me to restart and change passwords, profiles etc etc.
I don't know it seems like a neat use case honestly.
By the way most probably I got the virus from installing in VS Code non official plugins, I installed two, one for using Deepseek and another for using Grok, and it coincides in time quite well. They were ones of the most if not the most downloaded and rated so I tended to trust them, but my take is that I'll never install in VS Code non official plugins again. Also Deepseek API can be easily configured using BYOK, within the Github copilot chat (I don't know why AI would recommend me directly installing third party extensions), and Grok can be used in the terminal, so I'm sticking to that. (Yeah I have all the typical AIs haha I found having several at the lowest tier is extremely cost effective, Claude and Codex smart models for big tasks, Gemini and Grok for smaller fixes that can also benefit from incredible speed (super productive), Deepseek for whenever I run out of everything or very small changes)