# New ClickLock macOS Malware Coerces Users into Revealing Login Passwords Through Forced Screen Lockout


A sophisticated new macOS information-stealing malware called ClickLock has emerged as a significant threat to Apple users, deploying social engineering tactics combined with aggressive forced-interaction loops to extract sensitive credentials. Researchers at Group-IB discovered the malware on VirusTotal in June after it had already infected at least 100 systems across 33 countries since May 2026, with the malware remaining undetected by all major antivirus vendors at the time of discovery.


ClickLock represents a notable evolution in macOS malware tactics: rather than relying on exploits or requiring elevated system privileges, the threat uses brute-force coercion methods to force victims into surrendering their system passwords, cryptocurrency assets, browser credentials, and password manager data. The malware's aggressive persistence mechanisms, combined with its sophisticated multi-stage data harvesting, make it a concerning development for Mac users worldwide.


## The Threat: A Multi-Stage Information Stealer with Persistent Backdoor Capabilities


ClickLock is fundamentally designed as an information-stealing malware that captures a broad range of sensitive data from infected macOS systems. However, what distinguishes it from typical stealers is its sophisticated approach to password extraction through coercion rather than technical exploitation.


Primary targets include:

  • System login passwords
  • Cryptocurrency wallet assets and extension data
  • Browser saved logins, cookies, and autofill information
  • Password manager credentials
  • macOS Keychain authentication data
  • SSH keys and other authentication materials
  • Cached cryptocurrency addresses (EVM, Bitcoin, Solana, TRON, TON, Stacks)

    • Beyond immediate data theft, ClickLock can establish persistent backdoor access to compromised systems, suggesting ongoing remote access capabilities that extend far beyond the initial infection and data exfiltration phases.


    ## How the Attack Works: A Multi-Phase Coercion Strategy


    ClickLock employs a sophisticated multi-stage attack workflow that combines social engineering, notification suppression, and persistent forced-interaction loops.


    Phase 1: Initial Compromise via ClickFix Lure


    The infection typically begins through a ClickFix social engineering attack—a technique where victims are directed to paste a malicious command into Terminal. The attack chain works as follows:


  • Victims encounter a fraudulent Cloudflare "human verification" sequence displayed in Terminal
  • An animated progress bar creates the illusion of a legitimate system process
  • Keyboard interrupts are simultaneously disabled, preventing victims from stopping the script
  • The terminal cursor is hidden to obscure what's happening
  • Background processes begin downloading malware stealer modules without user knowledge

    • Phase 2: Notification Suppression


    A critical component of ClickLock's stealth strategy involves disabling macOS NotificationCenter for approximately six hours after infection. This window of suppressed notifications prevents legitimate system alerts from exposing the attack to the victim, giving the malware time to establish persistence and begin credential theft before the user becomes aware of compromised system behavior.


    Phase 3: Forced Password Entry Through Screen Lockout


    The malware's most aggressive tactic involves forcing victims to enter their system login password through a relentless loop of fake authentication dialogs:


    1. Initial Dialog: ClickLock displays a convincing fake macOS password prompt using the victim's actual username and a legitimate-looking Apple icon

    2. Validation & Exfiltration: If the victim enters their password, the malware validates the credentials against the system and immediately exfiltrates them via Telegram

    3. Persistence & Escalation: If the user cancels the dialog, the malware establishes persistence by installing two LaunchAgent files (com.authirity.plist and com.chromer.plist) that activate at the next system login


    Phase 4: Escalated Coercion Loop


    Once persistence is established, ClickLock deploys its most aggressive tactic: a termination loop configured to run every 210 milliseconds that:


  • Forcibly terminates all major system applications (Finder, Dock, Terminal, Activity Monitor, Console, System Settings, Spotlight, web browsers)
  • Displays only the password-stealing dialog on screen
  • Continues this cycle for up to 300,000 seconds (approximately 83 hours) or until the victim provides a correct password

    • This aggressive coercion mechanism leaves victims with minimal options—they either provide their password or face a completely unusable system for days.


    Phase 5: Keychain Authorization Attack


    A second LaunchAgent runs independently every 200 milliseconds to request Keychain authorization through a legitimate-appearing system prompt. The request seeks permission to access Chrome's Safe Storage key—the cryptographic key that protects stored passwords, cookies, and autofill data in Chromium-based browsers. This mechanism is configured to repeat for nearly 35 days (3 million seconds), providing multiple opportunities to trick users into granting access.


    ## Comprehensive Data Harvesting Capabilities


    Once credentials are obtained or persistence is established, ClickLock deploys an extensive data-harvesting module targeting:


    Browser Data Across Eight Platforms

  • Chrome, Firefox, Brave, Edge, Opera, Vivaldi, Arc, and Chromium
  • Saved logins, cookies, autofill data, bookmarks, local storage, and session storage

    • Cryptocurrency Assets

  • Wallet extension data from major wallets
  • Desktop wallet files
  • Encrypted vault materials for offline cracking attempts
  • Cached cryptocurrency addresses across EVM, Bitcoin, Solana, TRON, TON, and Stacks networks

    • Authentication & System Data

  • Password manager extension data
  • Shell command histories
  • FileZilla FTP configuration and server data
  • System information and public IP address
  • macOS authentication data

    • Data Exfiltration Method


    The malware packages all harvested data into ZIP archives and uploads them via the Telegram Bot API. Files exceeding 40 MB are automatically split into smaller chunks, with built-in retry logic ensuring successful exfiltration even if initial uploads fail. This approach leverages Telegram's infrastructure to avoid detection by traditional network monitoring tools.


    ## Attack Scope: 100+ Systems Across 33 Countries


    Group-IB's analysis revealed that ClickLock has successfully compromised at least 100 systems across 33 countries since May 2026. At the time of the initial report in mid-July, the malware remained completely undetected by all major security vendors on VirusTotal—a concerning gap that suggests widespread vulnerable populations may remain unaware of the threat.


    The global distribution of infections, combined with the malware's lack of detection, raises questions about whether the actual infection count exceeds reported numbers and how many additional systems may be compromised without knowledge.


    ## Why This Matters: The Evolution of macOS Threats


    ClickLock represents a significant shift in macOS malware tactics. Rather than exploiting system vulnerabilities or requiring elevated privileges, the malware succeeds through psychological manipulation and brute-force coercion. This approach offers several tactical advantages for attackers:


  • No patch required: Victims cannot patch their way out of social engineering attacks
  • No exploit needed: The malware works on fully patched systems
  • Persistent and relentless: Multiple coercion mechanisms ensure multiple opportunities to extract credentials
  • Broad data collection: The harvesting module captures nearly every valuable asset on a system

    • For Apple users accustomed to narratives about superior Mac security, ClickLock serves as a stark reminder that macOS remains a viable target platform for sophisticated threat actors.


    ## Recommendations for Users and Organizations


    For Individual Users:

  • Verify Terminal commands before pasting anything from external sources—even commands from seemingly legitimate websites
  • Never enter your system password in response to unexpected authentication prompts, especially those appearing in Terminal
  • Monitor system behavior for unusual process terminations or persistent authentication requests
  • Maintain backups stored offline in case of malware infection
  • Review Keychain permissions in System Settings and deny suspicious authorization requests

    • For Organizations:

  • Educate staff on ClickFix attack vectors and the dangers of pasting Terminal commands from untrusted sources
  • Monitor endpoint activity for unexpected process terminations or persistent LaunchAgent installations
  • Deploy behavioral detection that identifies repeated password dialog attempts or system application terminations
  • Restrict Telegram access on corporate networks to limit exfiltration channels
  • Review browser settings to understand which accounts and passwords may be cached locally

    • For Mac Administrators:

  • Disable or restrict LaunchAgent installation where possible through Mobile Device Management
  • Monitor for suspicious LaunchAgent files, particularly com.authirity.plist and com.chromer.plist
  • Enable FileVault encryption to prevent offline password attacks if systems are compromised
  • Require strong system passwords and consider biometric authentication where available

    • ---


    ## HackWire Analysis


    ClickLock exposes a critical vulnerability in macOS security assumptions: the notion that strong OS-level security eliminates malware risk. This threat succeeds not through technical sophistication, but through behavioral exploitation—it simply wears down victims until they surrender credentials.


    The malware's targeting of cryptocurrency assets and browser passwords reveals an attacker priority profile focused on high-value targets: users who likely hold crypto or manage financially sensitive accounts online. The 33-country distribution suggests this is not a geographically targeted campaign, but rather a broad-based operation capitalizing on the global reach of ClickFix social engineering vectors.


    What's particularly noteworthy is the six-hour notification blackout—this deliberate design choice indicates sophisticated threat actors who understand macOS internals well enough to weaponize them. They're not just stealing data; they're designing the attack lifecycle to maximize the window for establishing persistence before users realize what's happened.


    For defenders, ClickLock underscores that endpoint security on macOS requires behavioral monitoring, not just signature-based detection. A user education program that teaches skepticism toward unexpected Terminal commands and authentication prompts may be more effective than waiting for antivirus vendors to catch up. The fact that this malware remained undetected across all major vendors weeks after submission to VirusTotal is itself a red flag about AV effectiveness on macOS.


    Organizations managing Mac deployments should treat this as a wake-up call: Apple's security narrative is strong on *OS hardening*, but weak on *user behavior exploitation*. No amount of system-level security prevents a user from voluntarily entering their password into a fake dialog. The defense must shift upstream, toward user awareness and behavioral detection. — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)