ClickLock Suspicious process reading browser Cookies/Login Data SQLite databases

Kaung Khant Ko@kaungkhantko

•updated Aug 25, 2026•1•0•5

This rule detects suspicious activity involving common web browser credential files (Cookies, Login Data) being read, created, modified, or renamed by processes associated with iCloud synchronization paths on macOS. This behavior is indicative of potentially malicious processes attempting to exfiltrate browser-stored session information or credentials.