PSA: Fake "client meeting" scam targeting crypto/fintech workers — malware via Terminal

Got contacted by someone posing as a client for a call. The meeting link opened Zoom/Teams but showed an invalid meeting ID. When I flagged it, they sent a "fix" — a Terminal command to paste and run.
It was malware: downloaded an unsigned binary + shell script from wirevixbox.us, ran them silently in the background, then cleared the terminal to hide it. macOS's built-in warning for suspicious pasted commands is what caught it — I dismissed the warning but didn't hit Enter, so nothing executed.
Red flags to know:
• No legitimate meeting app ever needs a Terminal command to join
• Broken meeting ID + a suggested "fix" = the fix is the attack
• Silent background execution (nohup, /dev/null) + screen-clearing after = hiding evidence

Blocklist wirevixbox.us if you can. Reported to Google Safe Browsing and URLhaus. Sharing in case others in crypto/payments are getting targeted with the same pretext.