If you called the number or gave remote access
- Disconnect from Wi-Fi and Ethernet immediately
- Open System Settings → General → Sharing and turn off Screen Sharing, Remote Login, and Remote Management
- Open Applications and uninstall any remote-access tool they had you install (TeamViewer, AnyDesk, LogMeIn, Quick Assist, Zoho Assist)
- Restart your Mac and run a Malwarebytes scan
If you paid them
- Contact your bank and request a chargeback — explain it was a tech-support scam
- Cancel the card the payment was on
- If you used a gift card, contact the card issuer immediately — some can reverse unspent balances
If you pasted a Terminal or Script Editor command
Treat the Mac as compromised. Atomic Stealer (AMOS) and similar malware harvest browser passwords, crypto wallets, and Keychain entries within seconds.
- From a different device, change passwords for: email, banking, Apple ID, password manager, crypto exchanges
- Sign out of all sessions in Apple ID, Google, and your password manager
- Run a Malwarebytes scan on the Mac and remove anything flagged
- Consider a clean macOS reinstall if the Mac stored crypto wallet keys
Was this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers