ClickLock Mac malware locks apps until you give in

A regular "verify you are human" leafage should ne'er inquire you to unfastened Terminal, the Mac app utilized to tally machine commands. Yet that is however a caller malware onslaught appears to get onto a Mac. The leafage tells you to transcript and paste a bid into Terminal. It past shows a convincing advancement barroom portion the bid softly downloads malicious bundle successful the background.

Next, a password container whitethorn look that looks similar a mean macOS request. If you cancel it, the malware tin travel backmost aft you motion successful again and repeatedly adjacent Finder, your browser and different apps. Your Mac whitethorn consciousness astir intolerable to usage until you participate your login password.

The malware, called ClickLock, is built to bargain idiosyncratic accusation from your Mac. It searches for saved passwords, browser information and cryptocurrency wallet files. It tin besides instal a hidden instrumentality that lets an attacker reconnect to your machine aboriginal and power it remotely.

Researchers astatine cybersecurity institution Group-IB discovered the malicious publication connected VirusTotal, an online work that checks files for threats. Someone archetypal uploaded it determination connected June 9, 2026, yet nary of the information tools connected the level detected it astatine the clip of the researchers' report. Group-IB says the run has targeted astatine slightest 100 systems crossed 33 countries since May.

Here is however ClickLock takes implicit a Mac and what you tin bash to support yourself.

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Our escaped CyberGuy Live class, "Sick of Spam?" , has ended, but you tin inactive ticker the afloat replay and download our spam-stopping checklist. Kurt "CyberGuy" Knutsson walks you measurement by measurement done elemental ways to trim robocalls, spam texts, junk email and unwanted messages. You’ll besides larn however to curb governmental texts, cleanable up your inbox and spot messages that could enactment your idiosyncratic accusation astatine risk.

Get the escaped replay and checklist present astatine CyberGuyLive.com.

FAKE PASSWORD-MANAGER ALERTS COULD PUT YOUR VAULT AT RISK

ClickLock whitethorn statesman with a fake verification leafage that tells you to paste a bid into Terminal. (Kurt "CyberGuy" Knutsson)

What is ClickLock Mac malware?

ClickLock is simply a acceptable of malicious scripts designed to bargain delicate accusation from a Mac. The malware tin cod your Mac login password and browser data. It besides searches for cryptocurrency wallet files, password manager extensions and accusation stored successful macOS Keychain.

One constituent installs a persistent backdoor. That hidden transportation tin let an attacker to entree your Mac remotely adjacent aft the different parts of ClickLock region themselves.

ClickLock gets started without exploiting a known macOS flaw. It besides does not request admin-level entree astatine the beginning. Instead, the onslaught depends connected convincing you to tally the bid yourself.

How a fake verification starts the attack

Group-IB believes ClickLock apt spreads done a maneuver called ClickFix. ClickFix attacks amusement you a fake mistake oregon verification request. The leafage past gives you a bid that supposedly fixes the problem.

In this case, the ClickLock publication displays a fake Cloudflare verification series aft you paste the bid into Terminal. An animated advancement barroom cycles done reassuring messages astir checking browser signals and confirming you are human.

Meanwhile, the publication disables keyboard interruptions and hides the Terminal cursor. It past downloads respective malicious components successful the background. Researchers person yet to corroborate the nonstop landing pages utilized successful the campaign. They besides bash not cognize whether radical reached them done malicious hunt results, compromised websites, phishing messages oregon societal media. However, the script's plan powerfully points to a ClickFix-style lure.

The password trap starts with a convincing pop-up

After the malware begins running, it displays a fake macOS password window. The pop-up uses your existent username and an Apple icon downloaded by the attacker. If you participate a password, ClickLock checks it against your Mac. When the password works, the malware records it and sends it to the attacker done Telegram.

An incorrect password brings up different request. If you cancel the window, ClickLock installs 2 LaunchAgents. A LaunchAgent is simply a macOS acquisition that tin automatically tally bundle erstwhile you motion in. In this case, the LaunchAgents bring the password-stealing components backmost astatine your adjacent login.

HALLUSQUATTING AI ATTACK COULD HIJACK YOUR COMPUTER

The malware tin repeatedly adjacent apps and unit you to participate your Mac login password. (Kurt "CyberGuy" Knutsson)

ClickLock tin marque your Mac consciousness unusable

When the password-stealing module returns, it begins closing disposable apps each 210 milliseconds. It targets Finder, the Dock and Terminal. It besides shuts down Activity Monitor, System Settings, Spotlight and communal web browsers.

The fake password model whitethorn stay arsenic the lone utile point connected your screen. That tin marque your Mac look breached portion pressuring you to participate your password. Group-IB recovered that the loop tin tally for astir 83 hours. It stops earlier erstwhile the malware captures a valid password.

A existent Keychain punctual makes the onslaught much convincing

A 2nd ClickLock constituent targets Chrome's Safe Storage key. Chromium-based browsers usage this cardinal to assistance encrypt passwords, cookies and autofill accusation stored connected your Mac. An attacker with the cardinal and copied browser databases whitethorn beryllium capable to decrypt that accusation offline.

This portion of the onslaught triggers a genuine macOS Keychain authorization prompt. However, the malware caused the request. ClickLock past runs different process-closing loop portion waiting for you to o.k. access. Researchers recovered that this loop repeats each 200 milliseconds and tin proceed for astir 35 days. The publication besides suppresses macOS NotificationCenter for astir six hours. That could fell warnings oregon notifications that mightiness uncover the attack.

What ClickLock tin bargain from your Mac

ClickLock searches for accusation crossed 8 browsers. Those browsers see Chrome, Firefox, Brave, Microsoft Edge, Opera, Vivaldi, Arc and Chromium.

The targeted browser accusation includes:

• Saved usernames and passwords
• Cookies and progressive league data
• Autofill information
• Bookmarks and browser storage
• Cryptocurrency wallet extensions
• Password manager hold data

The malware besides searches for desktop cryptocurrency wallets and encrypted wallet vaults. It tin cod cached blockchain addresses crossed respective networks. Other targets see macOS Keychain, Terminal bid histories and FileZilla server details. The malware besides records basal accusation astir your Mac and its nationalist IP address. ClickLock packages the collected accusation into a ZIP archive. It uploads that archive done Telegram's Bot API. Files larger than 40 MB get divided into smaller pieces, portion retry codification keeps trying aft web failures.

If your Mac starts acting this way, unopen it down and restart successful Safe Mode earlier entering immoderate password. (Kurt "CyberGuy" Knutsson)

ClickLock tin permission a backdoor behind

One ClickLock constituent uses a modified mentation of the open-source GSocket tool. The malware installs a reverse shell, which gives the attacker a command-line transportation to your Mac. On macOS, it disguises the backdoor arsenic an iCloud-related process.

ClickLock uses a LaunchAgent and scheduled commands to support the backdoor running. It besides changes ammunition configuration files. Most of the different ClickLock modules delete themselves aft completing their work. The GSocket constituent remains installed, which means the attacker whitethorn clasp entree aft your Mac appears to instrumentality to normal.

Why ClickLock whitethorn beryllium hard to detect

The archetypal ClickLock publication had zero detections connected VirusTotal erstwhile Group-IB analyzed it. Security vendors whitethorn update their detection tools arsenic they larn much astir the threat. The attackers besides stored payloads connected compromised websites that antecedently had cleanable reputations. Some components tally without redeeming a mean record to the drive. Others erase themselves aft stealing data.

However, ClickLock inactive produces suspicious enactment portion it runs. Warning signs see nonstop app closures, repeated password requests and abrupt entree to aggregate browser folders. Security tools whitethorn besides observe antithetic connections to Telegram's API. For you, the earliest informing motion is overmuch simpler. A website tells you to paste a bid into Terminal. Legitimate quality verification happens wrong your browser. It should ne'er necessitate you to tally a Terminal command.

Ways to enactment harmless from ClickLock Mac malware

These steps tin assistance you debar the ClickLock trap and respond rapidly if the password loop starts.

1) Close immoderate website that sends you to Terminal

Leave the leafage erstwhile it tells you to unfastened Terminal and paste a command. A polished plan offers nary impervious that the petition is safe. Familiar logos tin besides beryllium copied. Group-IB warns that a website asking you to usage Terminal for verification is attempting to compromise your system.

2) Understand a bid earlier moving it

Terminal commands tin download bundle and alteration important settings. Never tally an unfamiliar bid simply to spot what happens. Ask a trusted method nonrecreational to inspect it first.

3) Question astonishment password requests

Think astir what you were doing erstwhile the password model appeared. A website verification should person nary crushed to inquire for your Mac login password. It should besides person nary crushed to petition entree to Chrome accusation stored successful Keychain. Cancel the petition erstwhile the timing feels wrong.

4) Keep macOS information protections current

Install macOS updates and support automatic information updates turned on. Apple builds malware extortion into macOS done Gatekeeper, Notarization and XProtect. Apple updates XProtect automatically arsenic it identifies caller malware. However, nary built-in extortion tin destruct each hazard erstwhile you manually tally a malicious command.

5) Use beardown antivirus software

Strong antivirus bundle tin supply different furniture of extortion against malicious files and suspicious behavior. Still, a cleanable scan cannot warrant that ClickLock near thing behind. The backdoor persists aft different components erase themselves. Get my picks for the champion 2026 antivirus extortion winners for your Windows, Mac, Android & iOS devices astatine Cyberguy.com

6) Shut down if your Mac starts closing apps

Do not participate your password to marque the pop-up disappear. Press and clasp your Mac's powerfulness fastener for up to 10 seconds until the machine shuts down. On a MacBook with Touch ID, property and clasp the Touch ID button. Group-IB recommends forcing a shutdown erstwhile your Mac becomes unresponsive and keeps requesting your password. The institution past recommends starting the Mac successful Safe Mode.

Mac with Apple silicon: Wait until the Mac shuts down completely. Press and clasp the powerfulness fastener until "Loading startup options" appears. Select your startup volume. Hold the Shift key, past click Continue successful Safe Mode.

Intel-based Mac: Turn connected oregon restart the Mac. Immediately property and clasp the Shift cardinal until the login model appears.

Once Safe Mode starts, crook disconnected Wi-Fi oregon unplug the Ethernet cable. Then interaction Apple Support oregon a trusted cybersecurity professional. Removing a browser hold oregon clearing your past volition not region ClickLock's persistent backdoor.

7) Secure your accounts from different device

Use a abstracted trusted instrumentality to alteration the password for your superior email account. Then unafraid your Apple Account and immoderate fiscal accounts stored connected the Mac. Change password manager credentials and reappraisal progressive sessions. Sign retired of devices oregon sessions you bash not recognize. Review the devices connected to your Apple Account and region unfamiliar ones. Apple besides recommends changing your Apple Account password erstwhile you fishy unauthorized access. After a nonrecreational cleans oregon resets the Mac, alteration its section login password. Assume the attacker received that password if you entered it into the ClickLock window.

Kurt's cardinal takeaways

ClickLock depends connected 1 unsafe moment: convincing you to paste a bid into Terminal. Once that happens, the malware tin statesman stealing accusation earlier the password unit adjacent starts. The biggest reddish emblem is casual to remember. No trustworthy website needs Terminal to beryllium you are human. If your Mac starts closing apps and demanding a password, unopen it down alternatively than giving in. Start successful Safe Mode and get assistance checking for the persistent backdoor. Then usage different trusted instrumentality to unafraid your astir important accounts.

Have you ever seen a suspicious password punctual oregon fake verification leafage connected your Mac? Tell america what it looked similar and what you did adjacent successful the comments below. Let america cognize by penning to america astatine Cyberguy.com

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report

• Get my champion tech tips, urgent information alerts and exclusive deals delivered consecutive to your inbox.
• For simple, real-world ways to spot scams aboriginal and enactment protected, sojourn CyberGuy.com - trusted by millions who ticker CyberGuy connected TV daily.
• Plus, you'll get instant entree to my Ultimate Scam Survival Guide escaped erstwhile you join.

Copyright 2026 CyberGuy.com. All rights reserved.