ClickLock Malware Pressures Mac Users Into Surrendering Their Passwords

A newly discovered macOS information stealer called ClickLock demonstrates that malware does not necessarily need to exploit a software vulnerability to compromise a computer. Sometimes, the attacker only needs to convince the victim to run the initial command and then make the computer so difficult to use that surrendering a password appears to be the only way out.

Researchers at Group-IB discovered ClickLock after analyzing a malicious shell script submitted to VirusTotal on June 9, 2026. At the time of their analysis, the script was not detected by any of the security products available through VirusTotal.

Group-IB says the operation has targeted at least 100 systems across 33 countries since May 2026. More than half of the identified victims were in Europe, although victims were also found in North America, the Middle East and Africa.

The malware can steal browser information, passwords, authentication data, cryptocurrency wallets and password-manager information. It can also install a persistent backdoor, allowing an attacker to return to the compromised Mac and remotely control it.

The infection apparently begins with ClickFix

Researchers believe ClickLock is distributed through a technique called ClickFix. These attacks present the victim with a fake technical problem, verification request or security check and instruct the person to copy a command and paste it into a terminal.

In ClickLock’s case, the command launches a fake Cloudflare verification sequence inside the Mac’s Terminal application. The victim sees an animated progress bar and messages claiming that the computer is verifying that the person is not a bot or collecting browser signals.

The animation is only a distraction. While it is displayed, the script disables keyboard interrupts, hides the Terminal cursor and downloads several additional malware components in the background.

Group-IB did not directly observe the phishing or ClickFix pages delivering the malware. Therefore, it remains unclear whether victims are reaching the malicious instructions through phishing messages, search-engine manipulation, social media, compromised websites or another method.

What researchers do know is that the victim must paste the malicious command into Terminal to begin the attack. Terminal is the macOS application used to enter command-line instructions, broadly comparable to Command Prompt or PowerShell on Windows. In this case, PowerShell may be the closer comparison because the pasted command downloads and runs additional scripts. ClickLock does not initially need an operating-system exploit or elevated privileges. The victim’s interaction supplies the initial access.

A fake password prompt using real information

ClickLock displays a fake macOS password dialog containing the victim’s actual username and an Apple icon downloaded by the malware. This makes the prompt appear more convincing than a generic request for a password.

If the victim enters a password, ClickLock checks whether it is the correct Mac login password before transmitting it to the attacker. Rather than simply accepting whatever is typed, the malware uses the legitimate macOS dscl command with the -authonly option to ask the operating system whether the password is valid. The password itself is not returned by macOS; instead, the system simply indicates whether authentication succeeds. This validation helps ensure the attacker receives a working credential instead of a mistyped or incorrect password.

Once the password has been verified, it is sent to the attacker through Telegram. The password can then be used to access protected information elsewhere on the Mac.

If the victim cancels the dialog, ClickLock does not simply give up. Instead, it installs two LaunchAgents named com.authirity.plist and com.chromer.plist. LaunchAgents allow programs or scripts to run when the user logs in, giving ClickLock another opportunity to pressure the victim.

Some readers may wonder what happens if the Mac does not have a login password configured. The published research focuses on systems protected by a password and does not describe special handling for passwordless accounts. In general, if there is no password to validate, there is no credential for ClickLock to steal through its fake login prompt. However, many Macs are configured with a login password because macOS uses it to protect sensitive resources such as the Keychain, authorize system changes and unlock encrypted data. Even on a passwordless system, other components of the malware, including its data-harvesting and persistence modules, may still be able to collect information available to the logged-in user.

Milliseconds, seconds, hours and days

Several different timing values appear throughout ClickLock’s operation. Understanding those values helps illustrate just how aggressive the malware can be.

The 210-millisecond termination loop

After the malware is reactivated, one password-stealing module begins terminating important applications every 210 milliseconds.

A millisecond is one-thousandth of a second. Therefore, 210 milliseconds is only 0.21 seconds. The termination command can run approximately 4.76 times every second, or about 286 times per minute.

The targeted processes include Finder, the Dock, Terminal, Activity Monitor, Console, System Settings, Spotlight and web browsers. With applications being terminated several times per second, the victim has almost no opportunity to open a utility, investigate the problem or regain normal control of the desktop.

This loop is configured to run for as long as 300,000 seconds. That equals 5,000 minutes, approximately 83.3 hours or almost three and a half days.

The victim is therefore not dealing with a password prompt that will disappear after a few cancellations. ClickLock is designed to maintain the pressure for days or until the correct password is supplied.

The separate 200-millisecond loop

The second LaunchAgent operates on a slightly faster interval of 200 milliseconds, or 0.2 seconds. That is five process-termination attempts every second and 300 attempts per minute.

This module uses a legitimate macOS authorization prompt while attempting to obtain permission to access Chrome’s Safe Storage key from the Mac’s Keychain.

The loop can continue for 3 million seconds. That equals 50,000 minutes, approximately 833 hours or nearly 35 days.

The difference between 200 and 210 milliseconds is only one-hundredth of a second. From the victim’s perspective, both loops are effectively continuous. The more significant difference is duration: the first may run for roughly three and a half days, while the second can continue for almost five weeks.

Six hours without Notification Center

ClickLock also suppresses the macOS Notification Center for approximately six hours. This may prevent warnings and other notifications from appearing while the attack is being established.

Six hours equals 360 minutes or 21,600 seconds. While the password loops use fractions of a second to create immediate pressure, the Notification Center suppression is intended to reduce the victim’s visibility into the attack over a much longer period.

The nine categories of information ClickLock targets

ClickLock deploys a separate data-harvesting module that searches for a broad collection of valuable information. BleepingComputer identified nine principal categories targeted by this module.

1. Data from eight web browsers ClickLock searches data belonging to Google Chrome, Mozilla Firefox, Brave, Microsoft Edge, Opera, Vivaldi, Arc and Chromium. Targeting multiple browsers increases the likelihood that the malware will find useful information even when the victim does not use Safari or Chrome as the primary browser.
2. Saved logins, cookies, autofill information, bookmarks and browser storage The malware collects saved usernames and passwords, cookies, autofill data, bookmarks, local storage and session storage.Cookies and session information can be especially dangerous because they may allow an attacker to hijack an existing authenticated session. In some circumstances, stealing an active session can allow access to an account without immediately entering the password or completing the normal login process.
3. Cryptocurrency wallet extensions and desktop wallet files ClickLock searches for browser extensions and desktop applications associated with cryptocurrency wallets. Wallet files may contain private information needed to access or recover cryptocurrency assets.
4. Encrypted wallet vault material Encrypted information is not necessarily useless to an attacker. The malware collects encrypted wallet vaults so they can potentially be attacked or cracked offline. An offline attack allows criminals to repeatedly test possible passwords on their own equipment without triggering the protections or rate limits of an online service.
5. Password-manager extension data ClickLock targets data associated with password-manager browser extensions. A compromised password manager can expose far more than a single account because it may contain credentials for email, banking, shopping, cloud storage, social networks and business services.
6. Cached cryptocurrency addresses The malware looks for cached addresses associated with six types of blockchain networks: Ethereum Virtual Machine networks, Bitcoin, Solana, TRON, TON and Stacks. These addresses can help attackers identify the cryptocurrency services and wallets used by the victim. They may also be useful for tracking transactions or preparing cryptocurrency-focused fraud.
7. Shell historiesCommand-line shells can retain a history of previously entered commands. These histories may reveal server addresses, usernames, file locations, administrative activity and commands containing credentials or authentication tokens.
8. FileZilla FTP configuration and recent-server information FileZilla is commonly used to transfer files to and from websites and servers. Its configuration and recent-server data may expose server addresses, usernames and saved connection details. If those credentials remain valid, the compromise could expand beyond the Mac to websites, hosting accounts or other remote systems administered from the infected computer.
9. Basic system information and the public IP address ClickLock collects basic information about the infected Mac and its public internet address. This helps the attacker identify the victim, distinguish one infection from another and understand the environment that has been compromised.

How the different modules work together

ClickLock is modular, meaning that its functions are divided among multiple scripts or components instead of being handled by one large program.

The initial orchestrator, called script.sh, begins operating after the victim pastes the command into Terminal. It presents the fake Cloudflare animation and downloads four principal components.

Researchers identified a credential-stealing component, a Keychain-stealing component, a cryptocurrency-focused harvesting component and a GSocket-based backdoor installer.

Two of the components are executed directly through the shell without first being stored as conventional files. The credential and Keychain modules are placed in a hidden directory under the victim’s home folder so they can be launched through the two LaunchAgents.

The credential-stealing module

The credential-stealing module presents the fake Apple password dialog and obtains the Mac login password. It validates the password before transmitting it so the attacker receives a credential that actually works.

If the victim refuses, the module uses the rapid process-termination loop to make the computer nearly unusable while continuing to display the password request.

The Keychain and Chrome Safe Storage module

The second module attempts to obtain Chrome’s Safe Storage key through the macOS Keychain. Unlike the initial fake password dialog, the request for Keychain authorization can use a legitimate system prompt.

Chromium-based browsers protect locally stored information using encryption connected to this key. If the attacker obtains both the browser databases and the Safe Storage key, saved passwords, cookies and autofill information can potentially be decrypted later on the attacker’s computer.

This is why the theft of an encrypted browser database should not be dismissed. ClickLock is attempting to steal both the locked information and the material needed to unlock it.

The data-harvesting module

The harvesting component searches browser profiles, password-manager extensions, cryptocurrency wallets, shell histories, FileZilla information and other system data.

Group-IB says the malware targets 31 cryptocurrency wallet browser extensions, seven password-manager extensions and eight desktop wallet applications, in addition to the eight supported browsers.

The backdoor module

The final major component installs a modified version of the open-source GSocket tool. This gives the attacker a persistent remote-access channel even after the information-stealing portions of ClickLock have completed their work.

Packaging and exfiltrating the stolen information

After collecting the targeted information, ClickLock creates a ZIP archive containing the stolen data and a summary log.

The archive is uploaded through the Telegram Bot API. Telegram provides the attacker with readily available internet infrastructure without requiring the criminal to operate an obvious dedicated command-and-control server for the data theft.

If the archive is larger than 40 megabytes, ClickLock divides it into smaller pieces. It also includes retry logic so an interrupted upload can resume after a temporary network problem.

This means a slow or unreliable connection may delay the theft, but it does not necessarily prevent it. The malware is designed to continue trying to transmit the information.

The use of ZIP files also allows many different categories of stolen data to be bundled into a manageable package. Browser databases, cookies, extension files, wallet information, shell histories, FTP configurations and system details can all be transmitted as part of the same collection.

What is GSocket?

GSocket is an open-source networking and tunneling toolkit developed by The Hacker’s Choice. One of its components, gs-netcat, can create an encrypted reverse connection through a relay.

A reverse connection means that the infected computer initiates the connection outward. This can be useful for legitimate remote administration and testing because the operator may not need to expose an incoming port directly to the internet.

Unfortunately, the same capability is useful to criminals. Instead of requiring an attacker to connect directly to the victim’s Mac, the malware and attacker can communicate through a relay.

GSocket is not inherently malicious. It is a legitimate, publicly available tool. The concern is how ClickLock modifies and deploys it.

The ClickLock version establishes persistence through several mechanisms, including a LaunchAgent, scheduled crontab entries and modifications to shell configuration files. It then connects through a GSocket relay, allowing an attacker to open a reverse shell and remotely issue commands on the Mac.

Most of ClickLock’s other modules remove themselves after completing their assigned tasks. The GSocket component is the exception: it remains installed to provide continuing access.

What GSocket abuse means for the Mac community

The inclusion of GSocket should concern Mac users and administrators for several reasons.

First, attackers do not need to develop an entirely new remote-access system. They can adapt a tested open-source project and concentrate on distribution, social engineering and avoiding detection.

Second, security tools may have difficulty making a decision based only on the presence of a legitimate utility. GSocket may be used by system administrators, researchers and penetration testers. Defenders must therefore examine how it was installed, which account is using it, where it is connecting and whether the user authorized the activity.

Third, the backdoor changes the nature of the incident. ClickLock is not limited to stealing one batch of information. A persistent reverse shell could allow an attacker to return, execute commands, install additional malware, steal newly created files or use the compromised Mac as an entry point to other resources.

Finally, its use demonstrates why Mac security cannot rely solely on identifying conventional application bundles. ClickLock begins as a shell script, runs some modules directly through the command interpreter and uses legitimate system capabilities and open-source software to complete the compromise.

How a possible Windows version might differ

Group-IB’s research describes a macOS campaign. There is no evidence in the published analysis that the current ClickLock malware has been deployed against Windows.

However, the underlying strategy could be adapted to Windows. ClickFix attacks already commonly instruct Windows users to paste commands into PowerShell, Command Prompt or the Windows Run dialog.

A Windows version would not be an exact copy because the two operating systems use different processes, credential stores and persistence mechanisms.

Terminal commands versus PowerShell

The macOS version persuades the victim to paste a shell command into Terminal. A Windows campaign could instruct the victim to paste a command into PowerShell, Command Prompt, Windows Terminal or the Run dialog.

PowerShell would be particularly attractive because it can download files, execute scripts, inspect the system and interact with Windows services and configuration settings.

Finder and the Dock versus Explorer and the Windows shell

ClickLock disrupts Finder, the Dock, Spotlight, Terminal, Activity Monitor, System Settings and browsers on macOS.

A Windows adaptation could repeatedly terminate or interfere with Windows Explorer, Task Manager, Windows Terminal, PowerShell, Command Prompt, Settings, security utilities and web browsers.

Terminating Windows Explorer could remove the desktop, taskbar and normal file-management interface. Repeatedly closing Task Manager and command-line utilities could make investigation and recovery more difficult.

LaunchAgents versus Windows persistence

The Mac version uses LaunchAgents, crontab entries and shell configuration changes to maintain persistence.

A Windows version could use Registry Run keys, the Startup folders, Scheduled Tasks, Windows services, PowerShell profiles or Windows Management Instrumentation subscriptions.

The exact mechanism would change, but the objective would be the same: ensure that the malware restarts after a reboot or when the user signs in again.

Keychain versus Credential Manager and DPAPI

ClickLock targets the macOS Keychain and Chrome’s Safe Storage key.

On Windows, browser passwords, cookies and other secrets are commonly protected through Windows facilities such as the Data Protection API, also known as DPAPI. A Windows information stealer could collect browser databases along with the user or system material needed to decrypt them.

It could also target Windows Credential Manager, application tokens, browser session cookies, cryptocurrency wallets, password-manager extensions, remote-desktop configurations and FTP clients.

Fake macOS prompts versus fake Windows dialogs

The current malware displays a fake macOS dialog containing the victim’s username and an Apple icon.

A Windows version could imitate a Windows Security prompt, a Microsoft account sign-in window, a User Account Control dialog, a browser verification request or an organizational login screen.

Depending on how it was designed, the malware might request the Windows account password, Microsoft account credentials or approval to run with administrative privileges.

GSocket could work across platforms

GSocket’s cross-platform nature is another reason a Windows adaptation is plausible from a technical standpoint. Attackers would not necessarily need to replace the remote-access concept. They could deploy a compatible Windows build or substitute another open-source tunneling or remote-access tool.

Again, this is a discussion of how the strategy could be adapted, not evidence that ClickLock currently has a Windows version.

The attack eventually makes the computer look normal again

After the stealing modules finish their work, they alter timestamps, remove many of their persistence mechanisms and delete themselves. The Mac may then return to apparently normal operation.

That return to normal can be misleading. By that point, the attacker may already possess the login password, Keychain information, browser databases, active session cookies, cryptocurrency wallet files, password-manager data, FTP credentials and shell history.

The GSocket backdoor may also remain installed, allowing continued remote access after the more visible password prompts and process disruptions have stopped.

The disappearance of the symptoms therefore does not mean that the threat has disappeared.

What Mac users should learn from ClickLock

The most important protection is straightforward: a website should not require someone to copy an unfamiliar command and paste it into Terminal to complete a CAPTCHA, confirm that the person is human, clean the computer or fix a browser problem.

A professional-looking page, familiar company logo or animated progress bar does not make such instructions legitimate.

If a Mac suddenly begins closing applications and repeatedly requesting the login password, entering the password may give the attacker exactly what is missing from the compromise.

Group-IB recommends forcing the computer to shut down by holding the power button and then starting the Mac in Safe Mode. Anyone who believes ClickLock has executed should also treat stored passwords, cookies, browser sessions and cryptocurrency wallet information as potentially compromised.

Active browser sessions should be revoked, passwords should be changed from a separate trusted device and cryptocurrency assets may need to be moved to new wallets using uncompromised recovery information.

Conclusion

ClickLock is noteworthy because it combines several familiar techniques into an unusually aggressive attack.

The initial ClickFix lure persuades the victim to launch the malware. A fake verification animation hides the download of additional components. Password dialogs and rapid process-termination loops pressure the person to surrender a working login password. Browser, password-manager, cryptocurrency and FTP data are collected and packaged into ZIP files. Telegram is used to transmit the stolen information, while a modified GSocket installation leaves behind a persistent remote-access channel.

The attack does not need to defeat every macOS security control directly. It manipulates the user into starting the compromise and then attempts to make resistance more difficult than compliance.

That may be ClickLock’s most important lesson: operating-system security features offer limited protection when a convincing website persuades someone to paste an attacker’s command into the computer and later pressures that person into supplying the password needed to unlock the remaining data.

Sources

• BleepingComputer: New ClickLock macOS malware traps users into revealing login password
• Group-IB: ClickLock Stealer: Paste Once, Lose Everything
• The Hacker News: New ClickLock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password
• The Hacker’s Choice: GSocket open-source repository