The Password Trap That Doesn’t Need an Exploit
You’re typing. The screen freezes. Finder vanishes. The Dock disappears. Your browser? Gone. All you see is a macOS login prompt — your username, Apple’s logo, a spinning progress bar. It looks real. It feels real. You enter your password. And just like that, you’ve handed over your entire digital life.
This isn’t a glitch. It’s ClickLock.
A new macOS information-stealing malware, first spotted by Group-IB in June, doesn’t exploit kernel flaws or bypass Gatekeeper. It doesn’t need to. It just waits. It kills everything. And then it asks nicely — repeatedly — for your password.
The attack is terrifying in its simplicity. No zero-days. No memory corruption. Just pure, surgical social engineering wrapped in the most trusted interface Apple offers: the system password dialog. And it’s working. At least 100 systems across 33 countries have been compromised since May.
What makes this different from every other phishing scam? It doesn’t trick you into clicking a link. It traps you in a loop you can’t escape.
How ClickLock Turns Your Mac Into a Prison
The infection starts with a shell script, often pasted into Terminal after a user visits a compromised site. The page might look like Cloudflare’s human verification screen — animated, professional, urgent. "Please complete the verification to continue." But instead of solving a CAPTCHA, you’re told to run a command.
The moment you do, the script disables your keyboard interrupts, hides your cursor, suppresses macOS NotificationCenter for six hours, and downloads the real payload in silence. By the time you notice something’s wrong, it’s already too late.
The malware then begins its two-phase coercion system.
The first loop kills every visible process — Finder, Dock, Terminal, Activity Monitor, System Settings — every 210 milliseconds. Then it spawns a fake password dialog. If you cancel? It waits. Then it kills everything again. And again. And again. This loop runs for 83 hours — or until you give in.
The second loop is worse. It doesn’t just kill apps. It targets your Keychain. Every 200 milliseconds, it triggers a legitimate macOS system prompt asking for permission to access Chrome’s Safe Storage key. If you approve — and most users do, thinking it’s a routine update — it decrypts your saved passwords, cookies, and autofill data.
This isn’t malware. It’s psychological warfare.
The Harvest: More Than Just Passwords
Once the password is stolen, ClickLock doesn’t stop. It goes fishing.
It sweeps through every browser: Chrome, Firefox, Brave, Edge, Opera, Vivaldi, Arc, Chromium. It grabs not just passwords, but cookies, session tokens, bookmarks, local storage, even cached cryptocurrency addresses across EVM, Bitcoin, Solana, and TON.
It hunts for wallet files — Ledger, MetaMask, Exodus, Electrum. Not just the wallet itself, but the encrypted vaults that might hold recovery phrases. It grabs FileZilla FTP configs, shell histories, even your recent Terminal commands.
The data gets zipped, split into chunks under 40 MB, and uploaded to Telegram via a bot API. Retry logic ensures delivery even if your internet stutters. And unlike the other modules, which self-delete after execution, one piece stays: GSocket.
The Ghost That Never Leaves
GSocket is the real horror. It’s a modified open-source tool turned into a persistent backdoor. It survives reboots through LaunchAgents, crontab entries, and shell profile modifications. It connects to a remote relay, giving attackers full reverse shell access.
This isn’t just a data thief. It’s a digital burglar who leaves the front door open.
And here’s the kicker: Group-IB says ClickLock leaves "a narrow detection window." The malware deletes itself. No files on disk. No registry entries. Just the behavioral fingerprints: osascript spawning dialogs, repeated process termination, mass access to browser profiles, and outbound Telegram traffic.
Most EDR tools won’t flag it. Not because they’re broken — because they’re looking for exploits, not coercion.
How to Protect Yourself (And Why Your Firewall Won’t Help)
Let me be blunt: if a website tells you to open Terminal and paste a command — no matter how legit it looks — close the tab. Now.
The most dangerous part of this attack isn’t the code. It’s the trust. You trust Apple’s interface. You trust the progress bar. You trust the fact that it’s asking for your password — something you’ve done a thousand times before.
Here’s what actually works:
- Never paste code from websites into Terminal. Ever.
- If your screen goes dark and a password dialog appears, hold the power button until the Mac shuts off. Don’t enter anything.
- Boot into Safe Mode. Run a full scan. Check your LaunchAgents folder for anything named com.authirity.plist or com.chromer.plist.
- Use a separate admin account for daily tasks. Lock down your main account.
- Enable two-factor authentication everywhere — especially for your Apple ID.
Firewalls? Antivirus? They’re useless here. This isn’t a virus. It’s a trick.
The Bigger Picture: AI-Driven Social Engineering Is Here
ClickLock isn’t an anomaly. It’s a preview.
We’ve spent years building defenses against code exploits. But what happens when the attack vector isn’t a buffer overflow — it’s your muscle memory?
This is the future of AI cybersecurity threats: not smarter malware, but smarter manipulation. Autonomous agents don’t need to hack your system. They just need to know you’ll enter your password when the screen goes black.
ClickLock is the first real-world example of an AI-powered coercion engine. And if we don’t start designing systems that don’t just ask for trust — but earn it — we’re all just waiting for the next one.
The real question isn’t how to detect ClickLock.
It’s how many more are already running.
— Kai Tanaka
