New 'ClickLock' Malware Steals Data by Tricking Mac Users
The malware, disguised as a verification process, prompts users to run commands in Terminal, then locks apps until sensitive information is extracted.
A new malware strain dubbed ClickLock is targeting Mac users by posing as a routine verification process, tricking individuals into running malicious commands through the system's Terminal application. Once executed, the malware can steal personal information and persistently lock down applications until the user's login password is provided.
First identified by researchers at cybersecurity firm Group-IB, the malicious script was uploaded to VirusTotal on June 9, 2026, but went undetected by security tools at the time. The campaign has reportedly affected at least 100 systems across 33 countries since May.
Initial Infection and Deception
The ClickLock attack typically begins with a deceptive webpage presenting a fake verification or error message, a tactic known as ClickFix. This page instructs users to copy and paste a command into macOS Terminal, a command-line interface for running system operations. In reality, this command initiates the download of malicious software in the background.
After the command is pasted, a convincing progress bar appears, leading the user to believe a legitimate verification is underway. Simultaneously, the script disables keyboard interruptions and hides the Terminal cursor, all while downloading several malicious components. The exact landing pages and initial access methods, whether through malicious search results, compromised websites, or phishing messages, are still under investigation.
The Password Trap and App Lockdowns
Following the initial execution, ClickLock displays a fake macOS password prompt, often using the user's actual username and an Apple icon to appear authentic. If a user enters their password, the malware captures it and transmits it to the attacker via Telegram. If an incorrect password is entered or the prompt is canceled, ClickLock installs two LaunchAgents, which are macOS instructions designed to automatically run software upon login. These LaunchAgents ensure the password-stealing components re-emerge on the next login.
When the password-stealing module becomes active, it begins rapidly closing visible applications such as Finder, the Dock, and Terminal every 210 milliseconds. It also targets Activity Monitor, System Settings, Spotlight, and common web browsers, making the Mac almost unusable. The fake password window may remain the sole visible item, pressuring the user to enter their password to regain functionality. This loop can persist for approximately 83 hours or until a valid password is captured.
Targeting Sensitive Data
ClickLock also employs a component that targets the Chrome Safe Storage key, which is used by Chromium-based browsers to encrypt sensitive data like passwords, cookies, and autofill information. This part of the attack can trigger a genuine macOS Keychain authorization prompt. While waiting for user approval, the malware restarts its app-closing loop. The script can also suppress macOS notifications for about six hours, potentially hiding warnings that could alert the user to the ongoing attack.
The malware searches for data across eight browsers, including Chrome, Firefox, Brave, Microsoft Edge, Opera, Vivaldi, Arc, and Chromium. It aims to steal saved usernames and passwords, cookies, session data, autofill information, bookmarks, browser storage, cryptocurrency wallet extensions, and password manager extension data. Additionally, it searches for desktop cryptocurrency wallets, encrypted wallet vaults, and cached blockchain addresses. Other targets include macOS Keychain, Terminal command histories, and FileZilla server details.
Persistent Backdoor
One of the more concerning aspects of ClickLock is its ability to install a persistent backdoor. Using a modified version of the open-source GSocket tool, the malware establishes a reverse shell, granting attackers a command-line connection to the compromised Mac. This backdoor is disguised as an iCloud-related process and is designed to remain active through LaunchAgents and scheduled commands, even after other ClickLock modules self-delete. This allows attackers to retain remote access to the system long after the initial attack appears to have concluded.
Protection and Mitigation
To protect against ClickLock, users are advised to be wary of any website that instructs them to open Terminal and paste commands, as legitimate human verification processes do not require this. Users should never run unfamiliar commands without understanding their purpose. Surprise password requests, especially those unrelated to ongoing tasks, should be treated with suspicion and canceled.
Keeping macOS security protections up-to-date, including automatic security updates, is crucial. While macOS has built-in protections like Gatekeeper, Notarization, and XProtect, these cannot fully prevent threats initiated by user action. Utilizing robust antivirus software can offer an additional layer of defense.
If a Mac begins exhibiting signs of the ClickLock attack, such as nonstop app closures and repeated password requests, users should immediately shut down the computer by holding the power button. It is then recommended to restart the Mac in Safe Mode. From there, disabling Wi-Fi or unplugging the Ethernet cable is advised before contacting Apple Support or a cybersecurity professional. Removing browser extensions or clearing history is insufficient to eliminate the persistent backdoor. It is also recommended to change passwords for critical accounts, including email, Apple ID, and financial accounts, from a separate trusted device.