ClickLock Mac malware steals crypto wallets and browser passwords across 33 countries
A new macOS infostealer called ClickLock has targeted at least 100 systems across 33 countries since May, with Group-IB researchers tracing the original script to a VirusTotal upload dated June 9, 2026, that carried…
A new macOS infostealer called ClickLock has targeted at least 100 systems across 33 countries since May, with Group-IB researchers tracing the original script to a VirusTotal upload dated June 9, 2026, that carried zero detections at the time of analysis. The malware reaches machines through a fake browser-verification page that instructs users to paste a command into Terminal, then works in the background to harvest cryptocurrency wallet files, browser credentials and macOS Keychain data before exfiltrating everything through Telegram's Bot API.
How the infection chain works
The lure follows a ClickFix pattern. A webpage presents a convincing Cloudflare verification sequence with an animated progress bar and reassuring messages about browser signal checks. While that runs, the script disables keyboard interruptions, hides the Terminal cursor and pulls down several malicious components in the background. Group-IB has not confirmed the exact landing pages used, or whether victims arrive through malicious search results, compromised websites, phishing messages or social media.
After installation, ClickLock displays a fake macOS password window built with the victim's real username and an Apple icon the attacker downloads separately. A correct password is verified against the Mac, recorded and sent to the attacker through Telegram. A wrong entry loops back to another prompt. Canceling the window triggers two LaunchAgents that restore the password-stealing modules at the next login.
The lock loop and what it collects
When the password module returns, it closes visible apps every 210 milliseconds. Finder, the Dock, Terminal, Activity Monitor, System Settings, Spotlight and common browsers all get shut down, leaving the fake password window as the only usable item on screen. Group-IB found the loop can run for roughly 83 hours, stopping sooner only when the malware captures a valid password. A separate module targeting Chrome's Safe Storage key runs its own process-closing loop every 200 milliseconds and can persist for nearly 35 days. The malware also suppresses macOS NotificationCenter for approximately six hours, potentially hiding alerts that could expose the attack.
ClickLock searches across eight browsers: Chrome, Firefox, Brave, Microsoft Edge, Opera, Vivaldi, Arc and Chromium. Beyond browser data, it scans for desktop cryptocurrency wallet files, encrypted wallet vaults, cached blockchain addresses, macOS Keychain contents, Terminal command histories and FileZilla server credentials. Collected material gets packaged into a ZIP archive and sent through Telegram's Bot API. Files exceeding 40 MB are split into smaller pieces, and retry logic keeps uploads running after network failures.
The backdoor that stays
Most ClickLock components delete themselves after completing their work. The exception is a modified version of the open-source GSocket tool. This component installs a reverse shell that disguises itself as an iCloud-related process, sustained by a LaunchAgent and scheduled shell commands. Group-IB warns the attacker may retain remote access long after the Mac appears to return to normal. The original script showed zero detections across all security vendor tools on VirusTotal when Group-IB filed its report.
Related reading
Filed via foxnews.com