Group-IB uncovers RemControl, a new Android banking trojan targeting European, Middle Eastern and Canadian banks, whose criminal infrastructure was unknowingly built by AI.

While analyzing global smishing operations spanning APAC, LATAM, Europe, and MEA, Group-IB researchers uncovered the 'Phoenix System' administrative panel, a centralized Phishing-as-a-Service (PhaaS) ...

Group-IB says crims forking out for Dark LLMs, deepfakes, and more at subscription prices Cybercrime has entered its AI era, with criminals now using weaponized language models and deepfakes as cheap, off-the-shelf infrastructure rather than experimental tools, according to researchers at Group-IB.…

Group-IBはAIによるディープフェイクで金融機関の生体認証を回避する攻撃手法を解説した。インドネシアでは1100件以上の詐欺が確認され、被害額は200億円越えを超えるという。

YouTube video by Group-IB

Security firm Group-IB has identified a new piece of macOS malware in the wild that pressures users into surrendering their passwords via a barrage of fake system prompts. Dubbed "ClickLock Stealer," the malware needs no exploits and no elevated privileges to work. Instead, the attack depends on the victim pasting a command into Terminal and running it. The command then executes a script, and everything else follows. Group-IB did not directly observe how victims are lured into pasting the command, but based on the script's behavior, the firm believes it's served through a fake "ClickFix" page posing as a Cloudflare check or browser verification step. Such pages instruct visitors to copy a command and run it in Terminal as a supposed "verification requirement." Once it's up and running, the script discreetly downloads several modules and shows a terminal-based loading animation mimicking a Cloudflare progress bar with browser verification. If a user declines the initial password dialog that appears, the malware starts locking system usage. Specifically, the malware kills every visible app every 210 milliseconds while the password prompt remains on screen, and the rest of the desktop stays unusable until the victim gives in. Meanwhile, another loop suppresses macOS security notifications for roughly six hours. If the user gives up and enters their password, a second, genuine macOS prompt is subsequently forced to the front, asking them to allow access to a Keychain item. Granting it hands over Chrome's "Safe Storage" AES key, which is what the browser uses to encrypt saved passwords and cookies. With the login password and Chrome's encryption obtained, ClickLock then harvests browser credentials, Keychain data, password manager vaults, and any cryptocurrency wallets, and then sends it all to a Telegram bot. It also installs a hidden backdoor disguised as an iCloud process to give it continual access. Group-IB says the campaign has been active since May 2026 and has targeted at least 100 victims across 33 countries. More than half of the victims were in Europe. Apple has already updated macOS to try to defend against this class of attack before it can get underway. In macOS Tahoe 26.4, it added a warning that appears when the user attempts to paste a command into Terminal from a website, chat, or message, and blocks the paste until the user reviews it. (Opera browser also recently added a similar feature.) In cases where macOS detects known malware, the paste is blocked outright with no override. Still, it should go without saying that no legitimate website will ever ask a user to paste a command into Terminal.Tag: macOS Security This article, "'ClickLock' Malware Coerces Mac Users Into Giving Up Passwords" first appeared on MacRumors.com Discuss this article in our forums

No illnesses reported to date.

One employee reaches a phishing page. The tab closes, the domain is blocked for every browser in the company, and the targeted password is already being reset. The new Group-IB Browser Agent brings the corporate browser under XDR coverage, checking every page against predictive Threat Intelligence in real time.