ClickLock Stealer: New macOS Malware via ClickFix

Group-IB has identified a new macOS malware operation, attributed to ClickLock Dev, utilizing a modular threat named ClickLock Stealer. Active since May 2026, the campaign leverages the 'ClickFix' technique, where victims are tricked into pasting malicious commands into their Terminal under the guise of browser verification or system fixes. The malware is specifically designed to bypass macOS protections without elevated privileges by using social engineering and persistent UI locking.

Technically, the threat is modular, consisting of an orchestrator, a Keychain stealer, a credential stealer, and a crypto-focused harvester. It employs an aggressive 'locker' technique that kills all interactive processes (Finder, Activity Monitor, etc.) every few hundred milliseconds until the user provides their password or Keychain authorization. The malware also installs a persistent backdoor using a modified version of the open-source GSocket tool. This operation has already impacted over 100 victims globally, with a significant concentration in high-income regions like Europe.

This threat is highly effective because it bypasses traditional security warnings by manipulating the user into performing the execution. Once established, it exfiltrates comprehensive data including Chrome encryption keys, browser profiles, and cryptocurrency seeds to Telegram-based C2 infrastructure. Organizations should be alerted to the rise of 'paste-to-terminal' social engineering vectors targeting macOS environments.