New ‘ClickLock’ Mac Malware Will Nag You Until You Hand Over Your Passwords
Toggle Dark Mode
Another day, another new malware discovered on the Mac. Or at least it sure feels that way. Security firm Group-IB has discovered ClickLock Stealer, a nasty new bit of Mac code that hijacks normal system behavior to convince targets to hand over their passwords and access to the machine.
The security firm says so far, ClickLock Stealer has spread to at least 100 targets scattered among 33 countries since May 2026. More than half the targets were located in Europe, although targets were also found in Africa, the Middle East, and North America.
Group-IB Threat Intelligence has discovered a malicious shell script that was uploaded to VirusTotal on June 9, 2026, and has zero detections at the time of analysis. Based on our research, it’s a new modular macOS stealer that is likely distributed via ClickFix pages and relies on compromised WordPress domains and Telegram infrastructure, with a strong focus on Europe where more than 50% of identified victims are located. It is also worth noting that the current malware doesn’t even need any elevated privileges or rely on exploits for the successful execution.
ClickLock is based on ClickFix, a known malicious scam that uses fake CAPTCHA or Cloudflare verification pages to convince users to paste and run commands in Terminal. ClickLock’s frosting on the scammy cake comes when it keeps pressuring the user, even if the user cancels a password prompt or refuses to grant access.
The script displays what appears to be a native macOS password prompt, with the victim’s username and an Apple icon. (Gotta trust it if it shows the Apple icon, right? Said every victim ever.) ClickLock then verifies the entry locally and sends only a correct password to a Telegram bot.
The attack launches after the user copies malicious code from a scammy website, then pastes it and runs it in Terminal. The script then goes to work, downloading multiple components that together attempt to collect data from the targeted machine’s browser, cryptocurrency information, and passwords. It also attempts to access the macOS Keychain to install a persistent backdoor to the machine.
Even if the user cancels the prompt, ClickLock simply creates LaunchAgents that run again upon login. This allows the components that harvest passwords and Keychain info to resume again after Terminal closes or the Mac is restarted.
Group-IB says that while it didn’t directly observe the malicious pages used to spread the nasty code in action, several aspects of the evilness — such as the fake Cloudflare interface, terminal-based progress bar animation, and other features — indicate the malware was created for ClickFix distribution.
The evil bit of code targets browser credentials, crypto-wallet data, shell history, Keychain data, password-manager records, and FileZilla login info. It also targets several apps and services including Chrome and Firefox, 1Password, Coinbase Wallet, Bitwarden, and others.
Disruption, Not Encryption
Unlike traditional malware, ClickLock doesn’t lock a Mac or encrypt its files and then hold the machine for ransom. Instead, it acts like a spurned lover, constantly nagging the victim to enter a password or approve a Keychain request, closing apps and system processes repeatedly until the victim gives in.
One component of this nasty bit of code can close Activity Monitor, Terminal, Finder, and other Mac elements as many as five times per second, says Group-IB. The password prompt is left as one of the few usable elements displayed on screen, making it difficult for users to investigate what’s going on or terminate the malware’s actions.
In addition to driving the user crazy until they give in, ClickLock also tries to suppress Notification Center for about six hours and can open the Full Disk Access panel in System Settings, in an effort to hide warnings and push the user to provide access.
Meanwhile, another component repeatedly asks for access to Chrome’s Safe Storage item in the macOS Keychain, which can help decrypt copied Chromium browser databases, which contain such important information as autofill information, cookies, and passwords.
While malware traditionally relies on exploits for security holes, many times requiring admin access, ClickLock simply attempts to convince the user to run the command and then uses legitimate-appearing prompts and tools to gain more access.
Doot, Doot, Doot, Doot, and in Your Backdoor!
While all of the above is going on, another module sneakily installs a modified version of the open-source GSocket tool inside a folder named “iCloudsync.” The module is designed to provide a persistent reverse shell, resulting in continued remote access.
While the other ClickLock components happily attempt to self-delete their files, altering timestamps once their nasty work is done, the GSocket backdoor keeps hanging around, making things appear normal, even though remote access is still enabled.
Group-IB says the malware campaign appears to be financially motivated, as it focuses on browser credentials, authentication information, and cryptocurrency wallets. However, the security firm has yet to identify the bad actors operating the campaign.
The original malicious shell script was discovered only after a user uploaded it to VirusTotal on June 9. The sample showed no VirusTotal detections when Group-IB researchers analyzed it.
How to Protect Yourself and Your Mac Against ClickLock Stealer
Stay alert! A CAPTCHA or Cloudflare-style verification page will never ask you to paste a command into Terminal. Legitimate browser verification will always happen inside the browser. Any page that tells you to open Terminal, no matter how professional it appears, is attempting to trick you into compromising your system.
If you’ve already run the command, you should immediately revoke active browser sessions and treat saved passwords, cookies, and wallet data as compromised. You should change passwords from a clean device and then check ~/Library/LaunchAgents/ and ~/.cacheb/ for any signs of infection.
Never provide passwords to unexpected password prompts. Instead, immediately shut down your Mac and reboot into Safe Mode, which allows you to better investigate what’s going on.
For more information about ClickLock Stealer, visit the Group-IB website.
