ClickLock makes Macs unusable to steal passwords

Group-IB identified ClickLock Stealer in a campaign active since May 2026. It has targeted at least 100 systems in 33 countries, with more than half of the identified targets in Europe. The initial command likely arrives through ClickFix-style pages, but Group-IB did not directly observe the landing pages.

After the command runs, ClickLock repeatedly terminates interactive apps about every 210 milliseconds. A fake password dialog remains on screen and pressures the user to enter credentials. One loop can run for about 83 hours; other components seek browser data, Keychain material, password managers, and crypto wallets, then send archives to Telegram.

ClickLock belongs to a category researchers call infostealers: malware whose goal is not persistence or ransom but a fast, thorough harvest of anything that grants access — saved browser passwords, session cookies, autofill data, cryptocurrency wallet files and system keychains. Stolen material is typically bundled and shipped out within minutes, then sold or reused for account takeover, which is why a stealer infection is best treated as a full credential compromise rather than a device problem.

The suspected delivery route matters as much as the payload. ClickFix is the name given to a social engineering pattern that has spread widely in recent years: a web page poses as a broken video player, a CAPTCHA or a fix-it instruction, and tells the visitor to copy a command and paste it into a terminal to resolve the supposed problem. The technique works because the victim performs the installation personally, stepping around the warnings an operating system attaches to downloaded programs. No vulnerability is exploited, so there is nothing for a security patch to fix.

It also fits a broader shift. Stealer families aimed at macOS have multiplied as the platform’s share has grown and as what Macs hold — developer credentials, corporate sessions, crypto wallets — has become more valuable. Built-in defenses such as Gatekeeper and XProtect were designed mainly around malicious downloaded applications; a user voluntarily typing a command into Terminal starts from a level of trust those mechanisms were never meant to police.

What distinguishes ClickLock is the pressure mechanic. Killing the user’s applications on a rapid loop while a password dialog stays on screen manufactures the feeling of a system failure that only a password can cure. It is crude but psychologically sound: someone watching their windows die several times a second is not in a state to scrutinize a dialog’s authenticity. And the password is the real prize, because on macOS the login password unlocks the Keychain, where the system concentrates saved credentials — coercing that one secret opens most of the rest.

There are reliable tells, even under pressure. Legitimate macOS password prompts do not reappear on a fixed loop, do not survive a reboot uninvited, and never originate from a webpage’s instruction to run a command. A genuine system dialog can always be escaped by shutting the machine down; anything that seems engineered to stop you from pausing and thinking is itself the warning sign.

This is not a conventional screen lock or a confirmed macOS exploit. It is social engineering that turns the desktop into a coercive prompt. Users should never paste a Terminal command suggested by a webpage. If the behavior appears, disconnect the Mac, shut it down, change passwords from a clean device, and seek professional remediation; Safe Mode alone is not proof of removal.

The remediation order exists for a reason: stealers act immediately, and once archives have left for Telegram, cleaning the Mac does not un-steal anything. That is why changing passwords from a different, known-clean device comes first — starting with email and any account that can reset others — and why professional help is worth considering once a machine has both been coerced and left running.

Prevention, meanwhile, is mostly habit. Treat any webpage that asks you to open Terminal as hostile, however plausible its story; no legitimate service fixes playback or verifies humanity that way. A password manager with unique per-site passwords, plus two-factor authentication on important accounts, limits what a single harvested keychain is worth. For organizations, the lesson is that this class of attack targets people rather than software, so it is countered by awareness and monitoring as much as by endpoint tooling.