{"id":51478,"date":"2026-04-03T14:14:42","date_gmt":"2026-04-03T18:14:42","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=51478"},"modified":"2026-04-13T11:40:27","modified_gmt":"2026-04-13T15:40:27","slug":"macos-26-4-paste-protection","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2026\/04\/03\/macos-26-4-paste-protection\/","title":{"rendered":"macOS 26.4 Paste Protection"},"content":{"rendered":"

Adam Codega<\/a>:<\/p>\n

\n

Apple does not<\/strong> inspect or analyze the contents of what you paste. Even harmless text like \"hello world\"<\/code> will trigger the warning under the right conditions.<\/p>\n\n

Instead, Terminal checks where the clipboard content came from<\/strong>. It does this by calling a private API _sourceSigningIdentifier<\/code> on the NSPasteboard<\/code>, which reveals the code-signing identity of the application that placed the content on the clipboard.<\/p>\n\n

If the source app matches a predefined list (74 apps total), the paste may be flagged.<\/p>\n<\/blockquote>\n\n

Via Jeff Johnson<\/a>:<\/p>\n

\n

The dialog is NOT displayed if Terminal app was opened within the last 30 days, or if developer tools are installed on the Mac.<\/p>\n<\/blockquote>\n\n

Dr. Drang<\/a>:<\/p>\n

\n

Surely, I thought, a command that pipes the contents of some random file on the internet into bash<\/code> for execution would be worth warning about. Nope. I copied the curl<\/code> command from Safari, pasted it into Terminal, and hit Return. No warning from macOS and my test folder and files disappeared again.<\/p>\n

My feelings about this have gone from “I hope Apple doesn’t make it impossible for me to work the way I normally do” to “Looks like Apple isn’t going overboard on the protection” to “Is there any protection here at all?”<\/p>\n<\/blockquote>\n\n

Patrick Wardle<\/a>:<\/p>\n

\n

You can read more about ClickFix attacks in MacPaw’s Moonlock Labs write-up: “How ClickFix attacks trick users and infect devices with malware<\/a>”<\/p>\n

[…]<\/p>\n

Long before macOS 26.4 (ok, like a month 😄), when Apple added native ClickFix protection, I had already added ClickFix protection to BlockBlock<\/a>[…]<\/p>\n

[…]<\/p>\n

The reason Apple doesn’t allow us to subscribe to these events—specifically ES_EVENT_TYPE_RESERVED_1<\/code> (the paste event)—is that it’s private, and thus only available to clients that possess the com.apple.private.endpoint-security.client<\/code> entitlement.<\/p>\n<\/blockquote>\n\n

Previously:<\/p>\n