The fake “free up disk space” Terminal scam targeting Mac users

In January 2026, people who googled “mac cleaner” started seeing ads for a helpful-looking cleanup guide. The guide was fake. The advertiser accounts were hijacked. And the command it told readers to paste into Terminal could hand their Mac to an attacker. Here is exactly how it worked, the one rule that defeats this scam forever, and the calm steps to take if you already pasted it.

Last updated: August 14, 2026 · ~7 min read · Full disclosure: we make Vaulith, a cleaner for Mac and Windows. This article asks you to paste nothing. That is the point.

What happened, step by step

On January 26, 2026, researchers at MacKeeper documented a live malvertising campaign running in Google search results (SC Media). Yes — MacKeeper, itself a Mac cleaner. Credit where it is due: their researchers caught it and reported the ads to Google.

The campaign worked like this:

1. The ads sat on everyday cleanup searches. “Mac cleaner” was the documented target, along with related queries like “clear cache macos” and “how to clear storage space on macbook air” (Macworld).
2. The advertisers looked legitimate — because they were. The ads ran from Google-verified advertiser accounts belonging to what appear to be real businesses whose accounts had been hijacked (SC Media, AppleInsider). The established reputation of those accounts helped the ads sail past review.
3. The landing page borrowed trusted ground. Clicking led to a fake guide styled after Apple’s support pages, hosted on trustworthy-looking domains — including docs.google.com (SC Media, Macworld).
4. The “fix” was a paste. The guide instructed readers to open Terminal and paste a command. The readable part printed reassuring progress text like “Cleaning macOS Storage.” The working part was scrambled with Base64 encoding, so a human glancing at it could not tell what it actually did (AppleInsider).
5. The payload phoned home. Once run, the command downloaded and executed a script with the user’s own permissions — enough to steal files, extract SSH keys, install further malware, or run cryptomining (SC Media).

Why it fooled careful people

Every trust signal a sensible person checks was present — and borrowed. The Google “verified advertiser” badge was real, on a hijacked account. The google.com domain in the link was real, hosting someone else’s document. The Apple look was pixel-copied. No single signal was fake enough to trip an alarm.

The lesson is not “trust nothing.” The lesson is that logos, badges, and domains can be borrowed. The one thing that could not be disguised was the command itself — it had to be unreadable, because a readable version would have shown its intent. Which gives us the rule.

The one rule: never run a command you can’t read

Base64 is an encoding that turns any text into uniform letter-soup. It is not encryption and it is not malicious by itself — computers use it constantly to package data. But in a cleanup guide aimed at ordinary users, it has exactly one purpose: to stop you from reading what you are about to run.

Here is the shape of the scam, defanged. Do not run commands like this from any guide, including this one — this example exists so you can recognize the pattern:

The shape of the scam — shown so you can recognize it, never run it

Read it right to left: take a scrambled blob, decode it, and pipe whatever comes out straight into a shell that executes it. Our blob harmlessly decodes to “nothing to see here.” The point is that you had no way to know that before running it. In the real campaign, that blob was the attack — and part of the pasted text deliberately scrambled the final instructions so antivirus tools and humans alike saw nothing meaningful (AppleInsider).

A legitimate guide has nothing to hide. Real cleanup commands name real folders in plain sight — you can see this standard in action in our own Xcode DerivedData guide, where every command says exactly which directory it touches and why it is safe. If a guide will not explain a command in words, do not lend it your Terminal.

If you pasted it: calm steps, in order

First, breathe. If you only visited the fake page and closed it, you are fine — the harm required running the command. If you did run something, work through this list today, not someday:

1. Check what launches at login. Open System Settings → General → Login Items & Extensions and look for anything you do not recognize. Then check the folders ~/Library/LaunchAgents, /Library/LaunchAgents, and /Library/LaunchDaemons for files added on the day you pasted. Malware plants entries here so it survives a restart, often under bland, system-sounding names.
2. Run a reputable scanner. Malwarebytes for Mac or the free KnockKnock from Objective-See will surface known persistence tricks that are easy to miss by hand.
3. Change your important passwords — from a different device. Email first, then banking, then anything reused. Turn on two-factor authentication where you have not already.
4. If you use SSH keys, rotate them. The campaign’s payload could extract SSH keys (SC Media). Generate new keys, add them to your servers and services, and remove the old ones everywhere they were authorized.
5. When in doubt, reinstall. If anything still feels off, back up your documents — files, not applications — and erase and reinstall macOS. It is a lost evening, and it is certainty.

How to never fall for the next one

This campaign will be cleaned up, and another will replace it. The defenses that survive every variant:

• Skip ads on utility searches entirely. When you are searching for cleaners, drivers, or system fixes, scroll past the sponsored slots. Better: type the vendor’s address directly.
• Download only from the vendor, then verify the download. Check the publisher name your OS shows before opening, and compare the file’s checksum against the vendor’s published list. Our verify-it-yourself page shows exactly how, with expected output.
• Prefer vendors with a published legal identity. A real company name you can look up, and signatures that match it. Our six-point checklist in “Are Mac cleaners safe?” covers this in five minutes flat.
• Hold every guide to the read-and-explain rule. Including ours. If you cannot read it, do not run it.

One more honest note: the scam impersonated a “free up disk space” guide because those guides are genuinely useful and widely searched. The real version of that article exists — here is ours, with every step explained and nothing to paste blind. And if you are curious how a real cleaner earns trust after an incident like CCleaner’s 2017 supply-chain compromise, our CCleaner comparison walks through that history with sources.

Keep going

• Are Mac cleaners safe? An honest answer — the six-point checklist that separates real cleaners from fakes.
• Does your Mac cleaner upload anything? — watch what any cleaner sends, with free tools.
• Free up disk space on Mac & Windows — the real version of the guide the scam impersonated.

Frequently asked questions

I clicked the ad but didn’t paste anything. Am I infected?

Almost certainly not. This campaign needed you to run the command yourself — that was its whole design. Visiting the page and leaving is not the infection path. If you want peace of mind anyway, run one of the free scanners listed above.

Weren’t the ads verified by Google?

Yes — and that is the most important detail of the whole story. The advertiser accounts appear to have belonged to real, verified businesses that were hijacked (AppleInsider). Verification badges tell you an account passed a check at some point. They cannot tell you who is holding the keys today.

Does Apple’s built-in security stop this?

Not reliably. Gatekeeper and notarization inspect apps you download. A command you paste into Terminal runs with your own permissions, at your own instruction — the system treats it as you doing something on purpose. That is exactly why the scam used a paste instead of a download, and why the read-and-explain rule matters.