Security firm Group-IB has uncovered ClickLock Stealer, a new Mac threat that hijacks normal system behavior to pressure victims into handing over passwords and access.
The firm said the campaign has reached at least 100 targets in 33 countries since May 2026, with more than half of the identified activity in Europe. Group-IB also found targets in North America, the Middle East and Africa.
ClickLock builds on ClickFix, a familiar scam that uses fake CAPTCHA or Cloudflare verification pages to convince people to paste commands into Terminal. ClickLock adds a coercive step when a victim cancels a password prompt or refuses access.
The attack begins only after the victim copies a command from a malicious page and runs it in Terminal. The script then downloads separate components designed to steal passwords, collect browser and cryptocurrency data, access the macOS Keychain and install a persistent backdoor.
Group-IB didn't directly observe the pages used to spread ClickLock. Researchers said the fake Cloudflare interface, verification language and terminal-based progress animation strongly indicate that the malware was built for ClickFix distribution.
Screenshot of the identified malicious shell script, which received no detections on VirusTotal.The script displays a native-looking macOS password prompt with the victim's username and an Apple icon. ClickLock verifies the entry locally and sends only a correct password to a Telegram bot.
Canceling the prompt does not stop the attack. ClickLock creates LaunchAgents that run when the victim logs in again, allowing the password and Keychain-stealing components to resume after Terminal closes or the Mac restarts.
ClickLock uses disruption instead of encryption
ClickLock doesn't encrypt files or permanently lock the Mac like conventional ransomware. Instead, it uses forced-interaction loops that repeatedly close apps and system processes until the victim enters a password or approves a Keychain request.
One component closes Finder, Terminal, Activity Monitor, System Settings and major browsers roughly five times per second, according to Group-IB. The process leaves the password prompt as one of the few usable elements on screen and makes the malware harder to investigate or stop.
Another component uses the same tactic while requesting access to Chrome's Safe Storage item in the macOS Keychain. The stolen key can help attackers decrypt copied Chromium browser databases containing passwords, cookies and autofill information.
ClickLock also tries to suppress Notification Center for about six hours and can open the Full Disk Access panel in System Settings. Group-IB said those actions appear designed to hide warnings and pressure the victim into granting broader access.
The malware doesn't rely on an exploit, and the initial script doesn't need administrator privileges. ClickLock works by convincing the victim to run the command, then using legitimate-looking prompts and macOS tools to demand more access.
A persistent backdoor raises the risk
Another module installs a modified version of the open-source GSocket tool inside a folder named "iCloudsync." Group-IB said the module is designed to provide a persistent reverse shell and continued remote access.
Most of the other ClickLock components try to delete themselves and alter file timestamps after completing their work. The GSocket backdoor remains installed, which can make the Mac appear normal while remote access continues.
ClickLock Stealer Kill chain outlining infection vector, loader stages, credential and cryptocurrency theft, and data exfiltration to Telegram bots. Image credit: Group-IBClickLock steals browser credentials, Keychain data, password-manager records, crypto-wallet data, shell history and FileZilla credentials. It targets apps and services including 1Password, Bitwarden, MetaMask, Coinbase Wallet, Chrome and Firefox.
Group-IB assessed the campaign as financially motivated because the malware focuses on cryptocurrency wallets, browser credentials and authentication data. The security firm hasn't publicly identified the operators behind the campaign.
The firm found the original malicious shell script after someone uploaded it to VirusTotal on June 9. Group-IB said the sample had no VirusTotal detections when researchers analyzed it.
How to protect yourself against ClickLock Stealer
A CAPTCHA or Cloudflare-style verification page should never ask users to paste a command into Terminal. Legitimate browser verification happens inside the browser.
Group-IB says anyone who ran the command should revoke active browser sessions and treat saved passwords, cookies and wallet data as compromised. Affected users should change passwords from a clean device and check ~/Library/LaunchAgents/ and ~/.cacheb/ for signs of infection.
A Mac that starts closing apps while showing an unexpected password prompt should be shut down rather than given the password, according to the report. Safe Mode can provide a better environment for investigation, though the startup process differs between Apple Silicon and Intel Macs.
