$14.99 — 70% off

Security firm Group-IB has identified a new piece of macOS malware in the wild that pressures users into surrendering their passwords via a barrage of fake system prompts. Dubbed "ClickLock Stealer," the malware needs no exploits and no elevated privileges to work. Instead, the attack depends on the victim pasting a command into Terminal and running it. The command then executes a script, and everything else follows. Group-IB did not directly observe how victims are lured into pasting the command, but based on the script's behavior, the firm believes it's served through a fake "ClickFix" page posing as a Cloudflare check or browser verification step. Such pages instruct visitors to copy a command and run it in Terminal as a supposed "verification requirement." Once it's up and running, the script discreetly downloads several modules and shows a terminal-based loading animation mimicking a Cloudflare progress bar with browser verification. If a user declines the initial password dialog that appears, the malware starts locking system usage. Specifically, the malware kills every visible app every 210 milliseconds while the password prompt remains on screen, and the rest of the desktop stays unusable until the victim gives in. Meanwhile, another loop suppresses macOS security notifications for roughly six hours. If the user gives up and enters their password, a second, genuine macOS prompt is subsequently forced to the front, asking them to allow access to a Keychain item. Granting it hands over Chrome's "Safe Storage" AES key, which is what the browser uses to encrypt saved passwords and cookies. With the login password and Chrome's encryption obtained, ClickLock then harvests browser credentials, Keychain data, password manager vaults, and any cryptocurrency wallets, and then sends it all to a Telegram bot. It also installs a hidden backdoor disguised as an iCloud process to give it continual access. Group-IB says the campaign has been active since May 2026 and has targeted at least 100 victims across 33 countries. More than half of the victims were in Europe. Apple has already updated macOS to try to defend against this class of attack before it can get underway. In macOS Tahoe 26.4, it added a warning that appears when the user attempts to paste a command into Terminal from a website, chat, or message, and blocks the paste until the user reviews it. (Opera browser also recently added a similar feature.) In cases where macOS detects known malware, the paste is blocked outright with no override. Still, it should go without saying that no legitimate website will ever ask a user to paste a command into Terminal.Tag: macOS Security This article, "'ClickLock' Malware Coerces Mac Users Into Giving Up Passwords" first appeared on MacRumors.com Discuss this article in our forums

$27.49 — 45% off

$14.99 — 70% off

$27.49 — 45% off

Security firm Group-IB has uncovered ClickLock Stealer, a new Mac threat that hijacks normal system behavior to pressure victims into handing over passwords and access.

A new macOS infostealer tricks victims into revealing their system password and installs a persistent backdoor for future access.

$23.99 — 52% off

A new macOS infostealer tricks victims into revealing their system password and installs a persistent backdoor for future access.

Newly documented stealer ClickLock comes for the more trusting Mac user with spot of social engineering

$23.99 — 52% off

Newly documented stealer ClickLock comes for the more trusting Mac user with spot of social engineering

Investigadores de segurança descobriram uma nova ameaça, o malware ClickLock Stealer dirigido a utilizadores Apple.

A newly discovered macOS malware dubbed ClickLock is raising alarms in the cybersecurity community for its aggressive and deceptive credential-harvesting techniques. According to researchers at Group-IB, the stealer employs a highly disruptive tactic that forcibly terminates running applications, effectively locking users out of their systems to coerce them into entering their macOS password. ClickLock represents a significant shift in macOS-focused threat activity, combining elements of traditional information stealers with user manipulation strategies more commonly seen in ransomware and scareware campaigns. This shift mirrors recent trends where Mac endpoints are targeted directly via the web, such as the Atomic Stealer ClickFix attack that works to bypass default system security warnings. New ClickLock macOS Stealer Kills Every App Once executed on a target system, ClickLock initiates a series of actions explicitly designed to destabilize the user environment. It systematically kills active processes, including security tools and productivity applications, leaving the system in a near-unusable state. ClickLock Stealer kill chain from potential phishing page (Source: Group-IB) This forced disruption is immediately followed by the display of a deceptive system prompt that perfectly mimics legitimate macOS authentication dialogs. Because the request appears authentic and is presented during a moment of high system instability, users are far more likely to comply out of a desire to restore functionality. The entered credentials are then captured and transmitted directly to the attacker-controlled command-and-control infrastructure. Group-IB researchers note that ClickLock leverages AppleScript and native macOS utilities to carry out its operations, allowing it to blend into legitimate system activity and evade basic signature-based detection mechanisms. The malware does not rely on sophisticated exploits or zero-day vulnerabilities; instead, it capitalizes entirely on social engineering and user trust in system prompts. This approach of using basic system utilities to stay silent matches the quieter installation updates seen in recent waves of competing Mac stealer families. Malware Feature Implementation Mechanism Core Security Objective Process Termination Loop killing active processes Induce system instability to panic the user Deceptive Prompting Spoofed AppleScript dialog windows Harvest the primary macOS login password Environmental Recon Native utility calls Collect hardware and environment metadata In addition to harvesting credentials, ClickLock is capable of collecting broad system information, including device details and user environment data. This information can be used to tailor further downstream attacks or sold on underground cybercrime marketplaces. The modular nature of the malware strongly suggests potential for future expansion, including the addition of automated data exfiltration or advanced persistence mechanisms. Comparison using kdiff3 tool (Source: Group-IB) “The effectiveness of ClickLock lies in its simplicity. By creating a controlled disruption and presenting a believable system prompt, the malware bypasses technical defenses and directly targets human behavior.” While the exact infection vector for ClickLock has not been definitively confirmed, researchers strongly suspect distribution through trojanized applications, malicious downloads, or targeted phishing campaigns. As macOS adoption continues to expand inside enterprise environments, threat actors are increasingly investing in platform-specific malware to exploit perceived gaps in user vigilance. To mitigate the risk posed by ClickLock and similar threats, organizations are advised to enforce the following behavioral guidelines: Prompt Verification: Avoid entering credentials into unexpected or suspicious prompts, especially immediately following abnormal system behavior. Behavioral Detection: Maintain endpoint protection solutions with advanced behavioral detection capabilities to catch process-killing loops. Verify System Behavior: Double-check the legitimacy of authentication requests and report forced application crashes to security teams. The emergence of ClickLock underscores the rapidly evolving threat landscape for macOS systems, highlighting that the platform is no longer a low-priority target for cybercriminals. As attackers refine their tactics by combining system-level disruption with credential theft, defenders must adapt by strengthening both technical controls and user awareness.  Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. ->  Integrate ANY.RUN With Your SOC  Now . The post New ClickLock macOS Stealer Kills Every App to Force Password Entry appeared first on Cyber Security News .

Newly documented stealer ClickLock comes for the more trusting Mac user with spot of social engineering

$14.99 — 70% off

ありふれたパスワード入力プロンプトが、あっという間にmacOSのデスクトップを危険な罠へと変貌させることがあります。実際、ClickLockという名の新種の悪質なプログラムが、オペレーティングシステムを完全に麻痺させます。そして、所有者が重要な認証情報を差し出すまで、あらゆる機能を執拗に停止させ続

$27.49 — 45% off

A new macOS information-stealing malware dubbed ClickLock terminates all visible processes to force users into entering their system login password.

Analysis of ClickLock, a modular macOS stealer delivered via ClickFix that uses fake dialogs, kill loops, and a GSocket backdoor to steal passwords, browser data, and crypto wallets.