Terminal for Non-Developers: Commands for Copying, Keyboard Shortcuts, and Protection Against TerminalFix
Navigate, search, copy, cancel: Terminal commands for Mac and Windows for copying, with screenshots of actual sessions and the BSI warning about the TerminalFix scam.
Date
Category
Author
The terminal used to be something only developers used. Today, freelancers and small businesses are also turning to it because AI tools like Claude Code and Codex run in the terminal, and because installation instructions increasingly start with “Enter this command.” That’s exactly what scammers are exploiting: Since September, the BSI has been warning about a scam in which a fake security check tricks you into entering a malicious command yourself.
This guide shows you the steps you need to take to navigate the Terminal with confidence, using screenshots from real sessions in a sample folder. Each command is enclosed in a box, and each line can be copied individually. We list the commands separately for Mac and Windows. We verified all information on October 7, 2026, against the documentation from Apple, Microsoft, and Anthropic, as well as the warning from the BSI.
In a nutshell (as of October 7, 2026)
Never enter a command that a website, a CAPTCHA, or a supposed support service tells you to enter. No legitimate test requires that. For everyday use, five commands for navigation and searching, the Tab key, and history search are all you need. And with Ctrl+C, you can cancel any command that freezes or takes too long to run.
Open the terminal and understand what you see
On a Mac, open Terminal using Spotlight; on Windows, open it from the Start menu. On a Mac, press ⌘ and the space bar, then type "Terminal." Since macOS Catalina, zsh has been the default shell for newly created user accounts; the command line ends with a percent sign. On Windows, open "Terminal" or "PowerShell"; the command line begins with P.S. and the current folder, such as PS C:\Users\anna>.
Read the command line as if it were an address. To the left of the character you're typing is the folder you're currently in. The tilde ~ stands for your user folder. Every command you enter takes effect in this folder, so the first thing to ask is always: Where am I?
Orientation: Where am I? What's around here?
With just three commands, you can navigate any folder. ls shows what's in the folder, cd switch to a different folder, cd .. goes back one level. With ls -lh You'll also see the size and date of each file. Here's what it looks like in an actual session:
A real session in bash using our example folder. In the Mac Terminal, the command line ends with % instead of $, but the commands are the same.
For Mac and Linux:
For Windows in PowerShell, where ls and cd The following also work:
Encloses names with spaces in quotation marks. cd My Files fails because the terminal sees two words. cd "My Documents" It works. Even easier: Drag the folder from Finder or Explorer into the Terminal window, and the full path will appear there, spelled correctly.
The Tab Key: No More Typing Out File Names
Type the first few letters and press Tab. The terminal auto-completes the name as soon as it is unique. If there are multiple matches, it auto-completes as much as possible, and pressing Tab a second time displays all possibilities. Below, we only have cd Re type and press Tab, then open 2026-10 and press Tab twice:
The tab adds "Re" to "Invoices/". If there are two matching offers, the second printout displays both for selection.
You can also use the Tab key as a spell checker. If the Tab key doesn't suggest anything, the name doesn't exist in that location. This prevents the "No such file or directory" error message. The Tab key works the same way in PowerShell; there, each additional press moves to the next match.
Find Files and Search Within Files
Use `find` to search for filenames, and `grep` to search for text in files. The period at the end means: here in the current folder and in all subfolders. -i is case-insensitive, -l shows only the file names instead of the locations.
`find` lists all PDFs, including those in subfolders. `grep` finds the note containing the word “invoice” and highlights it in color.
For Mac and Linux:
For Windows in PowerShell, where—according to Microsoft—searches are case-insensitive by default:
The process: never type the same command twice
Use the up arrow key to retrieve the last command, and Ctrl+R to retrieve any earlier ones. After pressing Ctrl+R, type part of the command, and the terminal will display the most recent matching one. Pressing Ctrl+R again jumps to the next older match; pressing Enter executes it, and the arrow keys highlight it for editing. Below, “grep -r” was enough to find the search command from earlier:
The reverse search in the history. The terminal displays the last command containing "grep -r".
These keyboard shortcuts save the most time in everyday use. The Mac shortcuts are taken from Apple's documentation and the default zsh configuration, while the Windows shortcuts are taken from Microsoft's PowerShell documentation:
Be careful with Ctrl+C in Windows. If text is selected in the terminal, Ctrl+C copies that text instead of canceling the command. Deselect the text first by clicking on it.
Create, copy, and rename folders
Use the -v option to see what happened. With -v The Terminal notifies you every time a file is copied or moved. Without this, it works silently, and you won't know if it worked. Renaming a file in the Terminal is the same as moving it, except it stays in the same folder:
Create a folder named "Archive," copy a quote into it, and rename the note file.
For Mac and Linux:
For Windows in PowerShell:
Get used to using the -i option, and the terminal will ask you before overwriting the file. cp and mv overwrite a file with the same name without prompting. And what you do with rm When you delete it, it doesn't go to the Trash—it's gone. If in doubt, it's better to delete it in Finder or Explorer.
Pay attention to the pointed bracket. With > writes the output of a command to a file, replacing the file's entire contents. With >> is simply appended. If you want to add a line and accidentally type just a parenthesis, you'll end up with a file containing exactly that one line.
When a command hangs
Press Ctrl+C to cancel any command that is currently running. Some commands run indefinitely until you stop them, such as ping, which checks the connection to a website. Pressing Ctrl+C closes it, after which the command line is ready for use again. According to Apple, on a Mac, ⌘ followed by a period also works.
ping runs until you stop it. The ^C indicates where we pressed Ctrl+C, followed by the output.
Press q if there's a colon at the bottom and nothing else works. The terminal opens longer documents, such as help pages, in a viewer. Use the arrow keys to scroll, and q You'll be able to get out of it. Here's how to open the help for each command:
Abbreviations That Stick
Create a shortcut for long commands that you use often. On a Mac, it goes in the file ~/.zshrc, which is read every time a new terminal window is opened. These two lines define the abbreviation ll For a detailed list, click here and reload the file:
In PowerShell, the file is called "Profile." An abbreviation with Set Alias This setting is valid only until you close the window. To make it permanent, create a profile with this setting and open it in the editor. There, you can then enter, for example, function ll { Get-ChildItem -Force } one:
The scam that's targeting your terminal
A website that prompts you to paste a command is an attack. In late August, Microsoft described a campaign called TerminalFix: Hacked websites display a fake Cloudflare verification that looks like a standard CAPTCHA. In the background, a malicious PowerShell command is copied to the clipboard. The on-screen instructions then prompt you to open Windows Terminal or PowerShell, paste the command, and press Enter.
The BSI classifies the situation as serious. In its security advisory dated September 4, 2026, it reports that German institutions have been compromised through this scam, resulting in data breaches and ransomware. According to the BSI, the script for the fake exam was found on several hundred websites. The severity level is “2 / Yellow”; measures must be taken promptly.
The first page of the BSI security advisory on TerminalFix, which may be freely distributed (TLP:CLEAR). Source: bsi.bund.de
Remember this one thing: No legitimate website, CAPTCHA, or support service will ever ask you to paste anything into the terminal, PowerShell, or the Run dialog (accessed by pressing Windows+R). If you see a request like this, close the tab and notify your team. If you’ve already pasted the text and pressed Enter, disconnect your computer from the network and call your IT service provider.
Never disable the paste warning in Windows Terminal. According to Microsoft, Windows Terminal warns you by default when you paste text that spans multiple lines or is larger than 5 KB, because commands can be executed immediately in such cases. In its post about TerminalFix, Microsoft recommends configuring Windows Terminal to warn you when pasting multi-line text. For Terminal on Mac, we didn’t find a comparable warning in Apple’s instructions; in that case, you’ll just have to pay close attention.
The scam continues to evolve. In late September, Microsoft reported that a Russian state-sponsored group was shifting from this type of attack to using rigged hard drive images. The rule remains the same: Do not run anything that a third-party website tells you to run.
Execute Installation Commands Safely
Copy installation instructions only from the manufacturer's official website. Commands such as curl … | bash or irm … | iex Download a program from the Internet and run it right away. This is standard practice for reputable developers; Anthropic installs Claude Code exactly this way. But be sure to check the address in the address bar before copying it, and never use a command from a forum, an email, or a video.
If you're unsure, download the script first and read through it. Instead of running it right away, save it as a file, take a look at it, and only then run it. Using Claude Code as an example:
Check downloaded files using the checksum. Many manufacturers publish a checksum for each file. If your number matches the one on the manufacturer's website, the file is unaltered:
Only use `sudo` if you know why. With sudo If you run a command with administrator privileges, it will have full access. The Terminal will remember your password for a few minutes afterward. With sudo -k stop sharing this immediately. Anthropic explicitly warns against using Claude code with sudo npm install -g to install.
AI Tools in the Terminal: Claude Code and Codex
Always launch AI tools from the folder in question. Claude Code and Codex work with all files in the folder where you launch them, as well as in its subfolders. So first, switch to cd in the project folder, never in your entire user folder. Run these commands and continue:
Before starting, check how much the tool is allowed to do without asking for confirmation. In the latest versions, Claude Code starts in Auto mode for all pricing plans; then, a second model running in the background checks primarily terminal commands and network access; reading and editing in the project folder is allowed without this check. Use Shift+Tab to cycle through the modes until “plan” appears at the bottom. In Plan mode, Claude reviews everything and suggests a plan, but doesn’t make any changes until you approve them. We explain all commands and modes in our guides “How to Use Claude Properly ” and “How to Use ChatGPT Properly.”
Ask for an explanation of an unfamiliar command before you execute it. If you come across a command you don't understand, ask an AI before you run it. This template works equally well in Claude and ChatGPT:
What Has Changed and What That Means for You
September 29, 2026: Microsoft reports that a state-sponsored group is refining this scam. For you, this means: The rule against executing commands from unknown sources still applies, even if the prompt looks different.
September 28, 2026: Claude Code will launch in Auto mode by default in every pricing plan, regardless of your settings. For you, this means: check the mode before working on customer files.
September 4, 2026: The BSI issues a warning about TerminalFix, with a criticality rating of “2 / Yellow.” For you, this means: briefly brief your team so that no one enters commands from websites.
August 28, 2026: Microsoft describes the TerminalFix campaign, which uses fake Cloudflare checks. For you, this means: Keep the paste warning enabled in Windows Terminal.
Date of this version: October 7, 2026. We regularly review the commands and warnings and update this post.
Want to know where the risk lies in your terminal?
We configure AI tools like Claude Code so that they only do what they’re supposed to, and we show your team the steps that matter in day-to-day work. Related: Using Claude Effectively · Performance: AI and Automation
If you contact us via our contact form, we'll respond within 24 hours—personally and without a sales pitch.
Sources
We have drawn on these sources for the commands, keyboard shortcuts, and safety instructions. As of November 4, 2026.
More Articles
© Marschfahrt Studio
Practical knowledge on web design, SEO, AI, and conversion optimization. Based on real projects, without any marketing spin.
