Executive Summary
ClickLock is a recently discovered macOS-focused information stealer and persistent backdoor, primarily active since May 2026. It utilizes the "ClickFix" social engineering vector, mimicking Cloudflare CAPTCHA or browser verification screens to trick technical users into executing malicious terminal commands. The threat is notably prevalent in high-income regions, with over 50% of targets located in Europe, particularly targeting developers and financial managers.
Technically, the malware excels at bypassing macOS security guardrails like Gatekeeper by stripping quarantine flags and applying ad-hoc digital signatures. If victims resist initial credential prompts, ClickLock initiates aggressive background loops that terminate critical system applications to force plaintext password entry. Beyond data theft, it establishes a permanent reverse shell using modified open-source tools to ensure long-term persistence even after the primary stealer components self-delete.
The business impact is severe, as the malware targets Chromium and Firefox-based browsers, 31 cryptocurrency wallet extensions, and system keychains. By acquiring the Chrome Safe Storage key, attackers can decrypt stolen corporate credentials offline, potentially bypassing Multi-Factor Authentication (MFA) via session cookie theft.