ctrlINT What the industry said about every indicator, with the quote

terminal[.]appDomain

Reported by 3 independent sources · first reported by Group-IB · last reported

Last reported 29 days ago

What the reports say

3 reports, newest first · the exact sentence from each

  1. “"Terminal[.]app" would like to access files in your Documents folder.”

    SANS Internet Storm CenterVendor
    A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)

  2. “Modification of persistence within a shell startup file (e.g., .zshenv), which will trigger upon opening Terminal[.]app”

    HuntressVendor
    From Screen Share to Root Access: Breaking Down CVE-2026-43760 and CVE-2026-65400 on macOS

  3. “Implement TCC (Transparency, Consent, and Control) monitoring to detect unexpected Full Disk Access grants, particularly to Terminal[.]app or shell interpreters.”

    Group-IBVendor
    ClickLock Stealer: Paste Once, Lose Everything

Indicators reported together

named in the same reports

Also named with it: CVE-2026-65400

Thanks — we review every report.

Report a wrong value
What is wrong with terminal[.]app here?
No account needed. We do not store your IP address.