# ClickLock Stealer: New macOS Malware Holds Apps Hostage Until Password Surrenders


A newly identified macOS infostealer called ClickLock is employing an aggressive coercion strategy rarely seen in the wild: repeatedly killing essential system applications every 210 milliseconds until victims capitulate and hand over their login credentials. The malware spreads via a single command copy-pasted into Terminal, making it trivial to deploy but devastating once installed.


Security researchers have documented that ClickLock leverages social engineering, fake system dialogs, and relentless application crashes to exhaust user resistance. When victims refuse the initial password prompt, the malware installs two LaunchAgents—persistent auto-launch mechanisms that ensure it runs on every subsequent login—then quietly exits. On the next boot, the system becomes unusable: Finder, the Dock, Spotlight, Terminal, Activity Monitor, and other critical applications crash in rapid succession until the user provides administrative credentials.


## The Threat: Attack Mechanics


ClickLock operates in distinct phases, each designed to progressively eliminate the victim's options for resistance:


Phase 1: Installation via Social Engineering

  • Attackers distribute a single-line command for users to paste into Terminal
  • The command downloads and executes the malware payload
  • A fake system dialog mimics macOS's legitimate authentication prompt, asking for the user's password
  • The dialog includes Apple branding and legitimate-looking security messaging

    • Phase 2: Persistence Installation

  • When the user cancels the fake dialog, ClickLock doesn't give up—it installs two LaunchAgents to /Library/LaunchAgents/ or ~/Library/LaunchAgents/
  • These agents ensure the malware relaunches automatically at each login
  • The malware then exits cleanly, leaving the system apparently normal

    • Phase 3: Coercion at Next Login

  • On the subsequent system restart or login, the installed LaunchAgents trigger
  • ClickLock immediately begins terminating critical system processes in rapid succession
  • Applications die every 210 milliseconds: Finder, Dock, Spotlight, Terminal, Activity Monitor, and others
  • This creates an unusable system state—users cannot open files, access the Dock, search for applications, or troubleshoot using standard tools
  • The only path to relief is surrendering the login password

    • Phase 4: Credential Theft

  • Once the password is captured, ClickLock has full access to the user's encrypted data, keychain, browser credentials, SSH keys, and cloud synchronization services
  • The attacker can now pivot to email accounts, financial services, cryptocurrency wallets, and any online account authenticated through stored credentials

    • ## Background and Context


    ClickLock represents an evolution in macOS malware tactics. Traditional infostealers rely on stealth—avoiding detection by running in the background and exfiltrating data quietly. ClickLock abandons subtlety in favor of psychological warfare.


    Why This Approach Works


    macOS users have historically faced fewer malware threats than Windows users, creating a false sense of security. The assumption that "Macs don't get viruses" remains deeply ingrained in user behavior. Additionally, the initial delivery mechanism—a Terminal command—is technically trivial to execute for users comfortable with command-line interfaces, yet feels legitimate because Terminal is a standard macOS developer tool.


    The fake system dialog exploits a second vulnerability: user familiarity with macOS authentication prompts. Users have been trained for years to enter their password when the system asks. ClickLock weaponizes this conditioning by mimicking that trusted interface.


    Escalation Through Frustration


    The 210-millisecond crash loop is psychologically sophisticated. It transforms the malware from a silent threat into an active, immediate problem. Users cannot wait it out, cannot troubleshoot, cannot access recovery tools. The only rational response becomes compliance. Some variants of this tactic have been observed in ransomware and aggressive adware, but its application to credential theft represents a refinement.


    ## Technical Details


    LaunchAgent Installation


    The two installed LaunchAgents are the malware's persistence mechanism. LaunchAgents run with user privileges and execute automatically at login. They are legitimate macOS features frequently abused by malware:


    Location: ~/Library/LaunchAgents/ or /Library/LaunchAgents/
Files: com.apple.clicklock.plist (or similarly spoofed name)
       com.system.clicklock.plist
Action: Triggers ClickLock reactivation at every login

    The file names are deliberately chosen to mimic legitimate Apple processes, reducing the likelihood that users examining their system will identify them as malicious.


    Credential Capture Method


    ClickLock's fake authentication dialog uses native macOS API calls to render a system-like interface. The implementation closely mirrors the appearance of:

  • System Preferences authentication
  • macOS Security & Privacy prompts
  • App-specific authentication dialogs

    • When credentials are entered, they are stored locally (likely encrypted with a hardcoded key or sent directly to attacker infrastructure) and the malware exits.


    Application Termination Loop


    The rapid-fire crashes are accomplished through repeated kill -9 signals targeting specific process IDs. The 210-millisecond interval is precisely calibrated: fast enough to prevent user intervention, slow enough that the system remains minimally responsive (e.g., the initial click to open System Preferences might register before the next crash).


    ## Implications for macOS Users and Organizations


    Individual Users

  • High Risk Groups: Developers, IT professionals, and users who regularly use Terminal (the most likely to paste an unfamiliar command)
  • Data Exposure: Full access to browser passwords, cryptocurrency wallets, SSH private keys, and encrypted messaging applications
  • Account Takeover: Attackers can reset passwords on email, financial, and social media accounts using stored credentials

    • Organizations

  • macOS is increasingly common in enterprise environments, yet security budgets often favor Windows endpoint protection
  • ClickLock targets high-value employees: developers with GitHub access, system administrators with infrastructure credentials, and executives with financial application access
  • The malware's effectiveness against standard macOS security (SIP, Gatekeeper) is unknown, but LaunchAgent persistence typically survives standard security software

    • Zero-Trust Implications

    Organizations assuming their macOS fleet is lower-risk than Windows should recalibrate. ClickLock demonstrates that sophisticated credential theft threats are actively targeting the platform.


    ## How to Protect Yourself


    Immediate Steps

  • Never paste commands from untrusted sources into Terminal—even if they appear to come from security researchers, GitHub, or tutorials
  • Verify command sources—review the command text carefully; hover over links to see their destination
  • Avoid admin-level commands from strangers—any command starting with sudo or referencing /Library/ or /usr/local/ should raise suspicion

    • Detection

  • Check ~/Library/LaunchAgents/ for unfamiliar .plist files (especially those mimicking Apple names)
  • Use Activity Monitor to identify unexpected processes launching at startup
  • Review system logs in Console.app for crash patterns and process terminations

    • Remediation (If Infected)

    1. Boot into Safe Mode or Recovery Mode (Cmd+R at startup) to prevent LaunchAgents from loading

    2. Delete the malicious .plist files from ~/Library/LaunchAgents/

    3. Consider a complete password reset for all accounts (the attacker likely has your login credentials)

    4. Change passwords for email, banking, cryptocurrency, and cloud services from a different device

    5. Enable two-factor authentication on all critical accounts if not already active

    6. Scan with reputable macOS security software (Malwarebytes, Kaspersky, etc.)


    Prevention

  • Use a password manager to generate unique passwords—limits damage if one account is compromised
  • Enable FileVault full-disk encryption (ClickLock steals the password but cannot decrypt the drive remotely)
  • Keep macOS updated to the latest version (Security patches reduce attack surface)
  • Install security software capable of monitoring LaunchAgent installation

    • ## HackWire Analysis


    ClickLock represents a significant shift in macOS malware strategy, and the trend should concern security teams. Rather than competing with antivirus software through stealth and obfuscation, ClickLock simply makes the system *unusable* until the attacker wins. It's a brute-force psychology attack disguised as malware—and it works because macOS users have been conditioned to believe their platform is inherently safer.


    What's particularly insidious is that ClickLock succeeds *because it fails gracefully*. The initial fake dialog can be dismissed without consequence. The LaunchAgent installation is silent. But then, at the next login when the user is most vulnerable—perhaps rushing to open their laptop for work—the system becomes deliberately hostile. The attacker has essentially weaponized the user's own expectations of a functioning computer.


    The technical sophistication is moderate, but the *psychological sophistication* is high. This mirrors a broader shift in attacks: social engineering and user manipulation are often more effective than zero-days or privilege escalation exploits. Organizations should treat this as a harbinger. If ClickLock succeeds in the wild, expect variants targeting Linux, Windows, and mobile platforms. And expect the coercion tactic to become normalized.


    For defenders, the lesson is uncomfortable: you cannot patch user behavior through security software alone. The most effective defense is awareness. IT teams should explicitly teach users to distrust Terminal commands—even "official-looking" ones—and to never paste commands they don't fully understand. That single behavioral change would make ClickLock and its variants nearly ineffective.


    — HackWire Editorial


    ## Recommendations for Security Teams


    | Action | Priority | Owner |

    |--------|----------|-------|

    | Audit macOS endpoints for suspicious LaunchAgents | High | IT Security |

    | Distribute user awareness training on Terminal command safety | High | Security/HR |

    | Deploy endpoint detection and response (EDR) capable of monitoring LaunchAgent creation | High | Security |

    | Enforce FileVault encryption company-wide | Medium | IT Operations |

    | Implement application whitelisting where feasible | Medium | IT Security |

    | Establish incident response plan for credential compromise | Medium | Security/Legal |


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)