ClickLock Stealer Terminal.app launch from browser process

Kaung Khant Ko@kaungkhantko

•updated Aug 25, 2026•24•0•41

This rule detects the launch of the Terminal application (Terminal.app) on macOS when initiated by a web browser process such as Safari, Chrome, Firefox, or Microsoft Edge. This behavior is indicative of a potential drive-by download attack or a malicious file execution sequence (e.g., ClickLock stealer) where browser-based interactions lead to the execution of system-level command line interfaces.