iTerm2
iTerm2 is a replacement for Apple’s Terminal that lets you run commands, scripts and connections to other computers. It’s made by George Nachman, based in the United States.
Criminals have used its name in fake downloads or scams, so get it only from iterm2.com.
What it is
iTerm2 is a text-based way to work with a Mac. People use it to run command-line programs and connect to remote computers. It supports tabs, split panes and searching terminal output.
It handles the commands you type and the output they produce. Programs run inside it can request access to files, devices and personal information. Optional AI features can share terminal contents and command history with the selected AI service, depending on the permissions you grant.
The project publishes its source code and security fixes. It is a reasonable tool for someone who regularly uses a terminal. Keep it updated and download it from the official website, as criminals have distributed fake copies and installation instructions.
Who makes it
George Nachman develops iTerm2, a free, open-source terminal app, and is based in Sunnyvale, California. Its website is iterm2.com.
Is it the real one?
Every Mac app carries a signature from the developer who made it. Apple checks who the developer is before handing out the certificate, and macOS refuses to open an app whose signature has been tampered with.
The real iTerm2 is signed by GEORGE NACHMAN, Apple team ID H7V7XYVQ7D. A copy signed by anyone else isn’t from George Nachman. HARD’s Mac app checks this for you; to check by hand, open Terminal and run codesign -dv "/Applications/iTerm2.app", and look for that TeamIdentifier.
Its bundle ID, the name macOS knows it by, is com.googlecode.iterm2. Download it only from iterm2.com, not from an ad or a link someone sends you.
Fakes. In September 2021, researchers reported a lookalike download site distributing an altered iTerm2 app containing ZuRu malware that stole files and credentials. In August 2025, CrowdStrike reported a fake iTerm2 GitHub repository whose installation command downloaded the SHAMOS information stealer.
What it connects to
In normal use, iTerm2 talks to these places on the internet. A firewall that asks before apps connect, like the one in HARD’s Mac app, will show them.
| Address | Why |
|---|---|
iterm2.com | Checks for software updates and downloads updates and Python runtimes. |
What it can see
macOS asks you before an app can use these. You can change them any time in System Settings → Privacy & Security.
| Permission | What it’s for |
|---|---|
| Accessibility | Supports the system-wide keyboard shortcut that shows or hides iTerm2. |
| Local Network | Lets commands and programs connect to devices on your local network. |
| Automation | May be requested when a program running inside iTerm2 uses AppleScript to control another app. |
| Camera | May be requested by a program running inside iTerm2 that uses the camera. |
| Microphone | May be requested by a program running inside iTerm2 that records audio. |
| Bluetooth | May be requested by a program running inside iTerm2 that uses Bluetooth. |
| Contacts | May be requested by a program running inside iTerm2 that accesses contacts. |
| Calendars | May be requested by a program running inside iTerm2 that accesses calendar data. |
| Reminders | May be requested by a program running inside iTerm2 that accesses reminders. |
| Photos | May be requested by a program running inside iTerm2 that accesses the photo library. |
| Location Services | May be requested by a program running inside iTerm2 that accesses your location. |
| Speech Recognition | May be requested by a program running inside iTerm2 that uses speech recognition. |
Security record
Problems with iTerm2 or George Nachman in the last three years, newest first. Keeping the app up to date covers the ones that were fixed.
| When | What happened | Source |
|---|---|---|
| AI chats could send messages to a cloud provider after a local or custom model was removed; version 3.7.7 fixed this behaviour. | ↗ | |
| CVE-2026-88514 allowed another local user to intercept restored terminal sessions and capture keystrokes and output; the project published a fix that authenticates the connection. | ↗ | |
| A security flaw in the bundled SIXEL image decoder, CVE-2026-44637, was fixed by updating the library in version 3.7.0beta6. | ↗ | |
| CVE-2026-41253 could allow specially prepared terminal output and files to trigger code execution; version 3.6.10 hardened the affected SSH integration. | ↗ | |
| SSH integration in versions 3.5.6–3.5.10 could leave terminal input and output in a file readable by other users on the remote computer; version 3.5.11 fixed it. | ↗ |
References
- iTerm2 official website iterm2.com
- George Nachman’s GitHub profile github.com
- iTerm2 documentation iterm2.com
- iTerm2 release configuration and permission descriptions raw.githubusercontent.com
- iTerm2 internet access policy raw.githubusercontent.com
- General preferences and automatic updates iterm2.com
- Keyboard preferences and system-wide shortcuts iterm2.com
- AI Chat permissions iterm2.com
- Official downloads and release notes iterm2.com
- Fix for interception of restored terminal sessions github.com
- CVE-2026-88514 record osv.dev
- NVD: CVE-2026-41253 nvd.nist.gov
- Malwarebytes: New Mac malware masquerades as iTerm2, Remote Desktop and other apps malwarebytes.com
- CrowdStrike: COOKIE SPIDER’s SHAMOS delivery on macOS crowdstrike.com
- The signature on a real installed copy, read by HARD with
codesign.