ClickLock Stealer Locks macOS Screens Until Victims Hand Over Their Password
Do Son 
ClickLock Stealer kill chain | Image: Group-IB Threat Intelligence
At a glance
| Malware family | ClickLock Stealer (new, named by Group-IB) |
| Threat actor | Unattributed. No actor or group named. |
| Target / victims | macOS users, especially crypto holders. At least 100 victims in 33 countries since May 2026, per Group-IB telemetry. |
| Delivery vector | ClickFix phishing pages (assessed with high confidence, not directly observed) |
| Key capabilities | Password and Keychain theft, crypto wallet harvesting, screen lockout coercion, GSocket backdoor |
| Source | Group-IB Threat Intelligence |
TL;DR
Group-IB Threat Intelligence found an undocumented macOS stealer and named it ClickLock Stealer. The malware freezes the desktop with a process kill loop until the victim types their login password. Group-IB counts at least 100 victims across 33 countries since May 2026.
Why ClickLock Stealer stands out
The sample landed on VirusTotal on June 9, 2026, with zero detections. It needs no exploit and no elevated privileges. Instead, it wins on social engineering alone. Group-IB’s full ClickLock Stealer technical breakdown puts the lesson plainly: “no legitimate website will ever ask you to paste a command into Terminal.”
Delivery: a fake Cloudflare check
Analysts did not observe the phishing pages directly. However, the script’s structure points to ClickFix delivery, and Group-IB assesses this with high confidence. The script opens with a fake Cloudflare CAPTCHA banner. It then animates a progress bar cycling through twelve status messages about bot checks and browser signals. Those elements serve no technical purpose. They exist only to reassure a user who just pasted a command into Terminal.
This macOS malware technique is not new. Microsoft reported ClickFix lures pushing Mac infostealers through fake utility installers, and noted a shift toward Terminal commands that fetch remote content. Netskope tracked similar AppleScript campaigns spread across dozens of short-lived lure domains.
Infection chain
The first script coordinates the attack. It blocks keyboard interrupts, hides the cursor, and runs the fake animation as cover. Meanwhile, it pulls four modules in the background from compromised WordPress sites. Two pipe straight into the shell and never touch disk. Two others land in a hidden folder for later launch.
Next comes a fake macOS password dialog built with osascript. It uses the victim’s real username and a downloaded Apple icon for credibility. The script validates any entered password against the local directory service, so only working credentials get sent onward.
The locker twist
Refusal does not help. If the user cancels, the script writes two LaunchAgents and quits quietly. On the next login, one module kills every visible app every 210 milliseconds. Only the password dialog stays usable. A second module applies the same pressure to a genuine Keychain prompt and grabs Chrome’s Safe Storage key. Group-IB found these loops configured to run for days. Another loop kills Notification Center for roughly six hours, muting security warnings.
Who gets hit
Group-IB telemetry shows at least 100 victims in 33 countries. More than half sit in Europe. North America follows, then the Middle East and Africa. The focus on wallets marks crypto holders as the main prize. Still, any Mac user with valuable accounts fits the profile.
Command-and-control and exfiltration
ClickLock Stealer runs no dedicated C2 server. Instead, it pushes stolen data to three Telegram bots and three compromised domains. Telegram gives operators encrypted transport that network filters rarely block.
The haul is broad. Modules target 8 browsers, 31 crypto wallet extensions, 7 password manager extensions, and 8 desktop wallets. They also take the Keychain, shell history, FTP credentials, and blockchain addresses across six chains. Encrypted wallet vaults go out as well, ready for offline cracking. A modified GSocket backdoor then stays behind as a disguised reverse shell.
Cleanup and evasion
Most modules erase their own tracks. They forge file timestamps by copying times from a rarely touched folder. Then they unload their LaunchAgents and delete themselves. Only the backdoor remains. As a result, timeline forensics gets much harder.
Attribution
No confirmed attribution exists. Group-IB names no threat actor and no group behind the campaign. The ClickFix delivery link is an analytical assessment, not a direct observation. Code structure also suggests the malware is still under development.
Detection and defense guidance
The detection window is narrow. Payloads sit on compromised domains with clean reputations, and most components self-delete. Group-IB therefore points defenders toward behavior rather than files. Watch for osascript spawning password dialogs. Flag rapid, repeated process termination across the desktop. Alert on Keychain credential lookups from unusual parent processes. Finally, watch for bulk reads of browser profile folders followed by outbound traffic to Telegram’s API.
For users, the rule stays simple. Real verification happens inside the browser. Any page that tells you to open Terminal is an attack, no matter how polished it looks.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
