ClickLock Stealer: New macOS Malware That Doesn't Exploit Bugs—It Tricks Users for Passwords

Group-IB disclosed a new macOS infostealer, ClickLock Stealer, that uses ClickFix social engineering to trick users into running malicious commands in Terminal. The malware repeatedly kills apps to coerce password entry and has hit at least 100 victims in 33 countries.

On July 16, 2026, cybersecurity firm Group-IB's Threat Intelligence team disclosed a previously undocumented macOS information-stealing malware—ClickLock Stealer. Its most notable trait: it relies on no software vulnerability or privilege-escalation technique. It purely uses social engineering to trick users into handing over the system password and sensitive data.

Incident Overview

ClickLock Stealer has been active since May 2026. At least 100 victims have been confirmed across 33 countries, with more than 50% in Europe and large numbers in North America, the Middle East, and Africa. Group-IB discovered the threat while analyzing a malicious shell script uploaded to VirusTotal on June 9, 2026—the sample had zero antivirus detections at the time.

Attackers host payloads on compromised WordPress sites and use Telegram infrastructure for command and control. The entire attack chain depends on a single act of user trust: pasting and executing a command from a webpage in Terminal.

Technical Details

Infection Chain: ClickFix Social Engineering

ClickLock infection starts with a ClickFix social-engineering lure—a fake Cloudflare CAPTCHA or verification page that instructs the victim to open macOS Terminal and paste a command to verify the browser session.

After the command runs, the malicious script:

• Disables Ctrl+C keyboard interrupt and hides the terminal cursor
• Plays a fake Cloudflare verification progress animation (~10 seconds)
• Silently downloads four payload components from two compromised WordPress sites

Forced Password Entry: Kill Loop

ClickLock's most abusive technical feature is a kill loop that activates on the next login. Every 210 milliseconds the malware runs pkill and killall, continuously terminating:

• Finder and Dock
• Spotlight and SystemUIServer
• Terminal and Activity Monitor
• NotificationCenter
• All major browsers

The entire macOS desktop becomes unusable. The only remaining UI is a fake macOS system password prompt—complete with a downloaded Apple icon and the victim's real username. If the user enters the wrong password or closes the dialog, the kill loop continues for up to 83 hours until the correct password is submitted or the timer expires.

Data Theft Scope

| Category | Target | | --- | --- | | Browser | Data from 8 Chromium-based and other browsers | | Cryptocurrency wallet extensions | 31 browser extensions | | Password manager extensions | 7 browser extensions | | Desktop cryptocurrency wallets | 8 applications | | macOS Keychain | Full contents | | Chrome Safe Storage | AES key (enables offline credential decryption) | | Shell history | Full .bash_history / .zsh_history | | FTP credentials | All stored credentials | | Blockchain addresses | Covering 6 different chains |

Persistence Backdoor

After exfiltration, the stealer component uninstalls its own LaunchAgent and deletes files (while forging timestamps to hinder forensics). A modified GSocket (open-source encrypted tunneling tool) remains for persistent remote access:

• Process name spoofed as SystemUIServerl (trailing lowercase l, mimicking legitimate SystemUIServer)
• Resides at ~/Library/Application Support/iCloudsync
• Connects via encrypted tunnel to attacker relay gsnc[.]eu:67
• Persists across reboots via remaining LaunchAgent

Impact Assessment

• Barrier to entry: extremely low—no vulnerability, no admin rights, social engineering only
• Target: macOS users, especially cryptocurrency holders
• Geography: Europe (>50%), North America, Middle East, Africa
• Development status: code structure and artifacts indicate the malware is still under active development
• Detection difficulty: high—relies on behavioral detection rather than known signatures

Remediation

User Protection

• Never paste commands from a webpage into Terminal—no legitimate service requires running a Terminal command to verify a browser session or CAPTCHA
• If desktop apps keep getting killed:
• Do not enter your password
• Force shutdown by holding the power button
• Boot into Safe Mode (Intel: hold Shift; Apple Silicon: hold the power button until startup options appear)
• Keep macOS updated—Apple added warnings against ClickFix-style attacks in Terminal in macOS Tahoe 26.4

Enterprise Detection

• Monitor anomalous password prompts and repeated application termination
• Detect anomalous access to browser data and stored credentials
• Monitor traffic to Telegram
• Hunt for a process named SystemUIServerl (note the trailing lowercase l)
• Check ~/Library/Application Support/iCloudsync for anomalous files

References

• Group-IB: ClickLock Stealer full technical analysis
• CosmicBytez: ClickLock kill loop analysis
• The Register: ClickLock Stealer incident coverage
• IntelFusions: ClickLock IOC list