New ClickLock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password

1. Executive summary

ClickLock Stealer is a previously undocumented macOS infostealer detailed by Group-IB, active since approximately May 2026, with at least 100 confirmed victims across 33 countries — over half in Europe. The malware uses the ClickFix social-engineering vector (fake Cloudflare verification pages) to trick users into pasting a shell command into Terminal, requiring no exploits or elevated privileges. Its distinguishing capability is a coercive "locker" loop that kills visible applications every 210 milliseconds for up to 83 hours, holding the desktop hostage until the victim enters their macOS login password. A completed run exfiltrates the macOS Keychain, Chrome's Safe Storage AES key (enabling offline decryption of saved passwords and cookies), credentials from eight browsers, 31 crypto wallet extensions, seven password manager extensions, eight desktop wallets, shell history, and FileZilla FTP credentials — posing a direct credential-and-wallet-theft risk to EMEA financial services staff who may be targeted through compromised WordPress payload hosts.

2. Regulatory framing

No NIS2 or UK NIS article is specifically engaged beyond generic incident-response obligations; the trigger facts (social engineering, credential theft) are not distinctive enough to this item to change what a client must do under those regulations compared to any other infostealer incident.

3. Technical analysis & attack chain

Attribution caveat: Group-IB is the sole source for this analysis. No named threat actor has been identified, and no MITRE ATT&CK profile is available in the verified reference data. Attribution is unconfirmed. All technical detail below is single-sourced (Group-IB via The Hacker News and The Register); verify before enforcement.

Attack chain (confirmed steps)

1. Initial access — ClickFix social engineering. The victim encounters a fake verification page (assessed with high confidence as ClickFix by Group-IB, though no lure page has been recovered). The page displays a fake Cloudflare CAPTCHA banner over a progress bar cycling twelve status lines in ten seconds. The victim is instructed to copy a command and paste it into macOS Terminal. The script takes a RAY_ID as its first argument.
2. Execution environment preparation. The orchestrator script (script.sh) disables keyboard interrupts and hides the terminal cursor. It then pulls four payloads from two compromised WordPress sites. Two payloads pipe directly into bash; two are written to a hidden directory at $HOME/.cacheb/.
3. Soft credential ask. An osascript dialog is displayed, using a downloaded Apple icon and the victim's real username. Any entered password is validated against dscl /Local/Default -authonly before transmission — only a working password is accepted. This dscl validation technique was previously documented by Microsoft in SHub Stealer (May 2026), and is shared with AMOS and MacSync in the same ClickFix campaign wave.
4. Persistence — LaunchAgents. If the victim cancels the initial dialog, the script drops two plist files into ~/Library/LaunchAgents/: - com.authirity.plist — fires the 210-millisecond kill loop at next login until a password is entered. - com.chromer.plist — launches its own kill loop at 0.2-second intervals for up to 3,000,000 seconds (~34.7 days), while a background process queries the Keychain for Chrome's Safe Storage key every 0.5 seconds. That Keychain query raises a legitimate macOS prompt; the kill loop holds the desktop hostage until the victim approves it.
5. Coercive locker loop. At next login, the following applications are killed every 210 milliseconds: Finder, Dock, Spotlight, Terminal, Activity Monitor, and major browsers. The loop runs for up to 83 hours. Activity Monitor and Terminal are on both kill lists, preventing the victim from investigating or terminating the process. A third loop kills NotificationCenter for six hours, suppressing any Gatekeeper warning dialogs.
6. Full Disk Access escalation. If Terminal lacks Full Disk Access, the orchestrator opens System Settings to the correct pane and walks the victim through granting it.
7. Data theft. Once the password is supplied (or the Keychain prompt is approved), the malware exfiltrates: - macOS Keychain - Chrome's Safe Storage AES key (enables offline decryption of Login Data and Cookies databases on the attacker's machine) - Browser credentials and cookies from eight browsers - 31 cryptocurrency wallet browser extensions - Seven password manager extensions - Eight desktop wallet applications - Shell history - FileZilla saved FTP credentials - Blockchain addresses spanning six chains

All stolen data is packaged into a ZIP archive for exfiltration.

8. Command-and-control — Telegram. Exfiltration is performed via Telegram infrastructure. The backdoor component, dubbed goyim, is approximately 80 percent a copy of the public deploy script for GSocket (an open-source tunneling toolkit from The Hacker's Choice), which provides encrypted reverse backdoor access via the gs-netcat component.
9. Post-reboot behaviour. If the machine is rebooted instead of complying, the LaunchAgent persistence mechanisms resume the attack at next login.

Key technical notes

• The orchestrator script was uploaded to VirusTotal on June 9, 2026, with zero antivirus detections at time of analysis.
• No exploit or elevated privilege is required for execution; the entire chain relies on the user pasting the command.
• Group-IB assesses the malware is still under active development based on code structure and artefacts.
• No lure domains have been recovered; only three compromised payload hosts are known. The initial infection vector (what drives traffic to the fake verification pages) is unconfirmed.

4. Mitigation & containment

P1 — Within 24 hours

• EDR / endpoint blocking: Block execution of osascript spawned from Terminal sessions where the parent process is a shell script downloaded via curl or wget. Create detection rules for any process writing .plist files to ~/Library/LaunchAgents/ from a Terminal context.
• Hunt for known persistence: Check all macOS endpoints for the presence of ~/Library/LaunchAgents/com.authirity.plist and ~/Library/LaunchAgents/com.chromer.plist. Delete if found and investigate the host for data theft.
• Hunt for payload cache: Check for the hidden directory $HOME/.cacheb/ on all macOS endpoints.
• Network controls: Block outbound connections to Telegram API endpoints from non-corporate-managed applications where feasible. Monitor for GSocket (gs-netcat) traffic patterns — encrypted reverse tunnel connections to unknown external hosts.
• User advisory: Issue an immediate warning to all staff: no legitimate Cloudflare, Google, or verification service will ask users to open Terminal and paste a command. Any such request is malicious.

P2 — Within 72 hours

• Full Disk Access audit: Review which applications and terminal contexts have Full Disk Access granted on macOS endpoints. Revoke unnecessary grants. The malware relies on FDA to access Keychain and browser data.
• Browser credential hygiene: For any confirmed-impacted user: revoke all active browser sessions, treat every saved password and cookie as compromised, force password resets on all accounts whose credentials were browser-stored. Rotate FileZilla FTP credentials if the tool was installed.
• Keychain rotation: For confirmed victims, rotate the macOS login password and assess whether Keychain contents (including any stored service credentials, certificates, or Kerberos tickets) require revocation.
• Crypto wallet assessment: If desktop wallet applications or wallet extensions were present on a confirmed victim's machine, treat all wallet keys as compromised and initiate key rotation per wallet provider procedures.

P3 — Within 7 days

• MDM policy hardening: Deploy or update MDM configuration profiles to restrict Terminal execution for non-technical staff where business-appropriate. Consider Gatekeeper and spctl enforcement to block unsigned scripts.
• LaunchAgent monitoring: Deploy a monitoring agent (or use MDM's declarative configuration) to alert on any new .plist creation in ~/Library/LaunchAgents/ or /Library/LaunchAgents/.
• Threat hunt: Search historical endpoint telemetry (last 90 days) for the behavioural indicators in §5 — repeated process kills at sub-second intervals, dscl /Local/Default -authonly invocations from non-login-window contexts, and outbound Telegram API traffic from macOS endpoints.

5. Indicators of compromise

No atomic network indicators (domains, IPs, URLs) are available in the source material. Group-IB references three compromised payload hosts and Telegram C2 infrastructure but does not publish the hostnames, IPs, or Telegram identifiers in the sourced articles.

Behavioural indicators

6. Detection

rule ClickLock_Stealer_macOS {
  meta:
    author = "Adverse Trace"
    date = "2026-07-16"
    reference = "https://thehackernews.com/2026/07/new-clicklock-macos-stealer-kills-apps.html"
    description = "Detects ClickLock Stealer orchestrator script and payload components for macOS"

  strings:
    $plist1 = "com.authirity.plist" ascii
    $plist2 = "com.chromer.plist" ascii
    $cacheb = ".cacheb/" ascii
    $ray_id = "RAY_ID" ascii
    $dscl = "dscl /Local/Default -authonly" ascii
    $gsocket = "gs-netcat" ascii
    $goyim = "goyim" ascii

  condition:
    3 of them
}

title: ClickLock Stealer LaunchAgent Persistence Creation
id: 7a3c1f2e-4b5d-4a8e-9c1f-0a6b2c3d4e5f
status: experimental
description: Detects creation of ClickLock Stealer LaunchAgent plist files in user Library
author: Adverse Trace
date: 2026/07/16
references:

  - https://thehackernews.com/2026/07/new-clicklock-macos-stealer-kills-apps.html
logsource:
  product: macos
  category: file_event
detection:
  selection:
    TargetFilename|contains:

      - "~/Library/LaunchAgents/com.authirity.plist"
      - "~/Library/LaunchAgents/com.chromer.plist"
  condition: selection
falsepositives:

  - Unknown — filenames are deliberately typosquatted and unlikely to appear in legitimate software
level: critical

title: ClickLock Stealer Coercive Process Kill Loop
id: 8b4d2g3f-5c6e-4b9f-ad2g-1b7c3d4e5f6a
status: experimental
description: Detects rapid repeated termination of macOS system processes consistent with ClickLock locker loop
author: Adverse Trace
date: 2026/07/16
references:

  - https://thehackernews.com/2026/07/new-clicklock-macos-stealer-kills-apps.html
logsource:
  product: macos
  category: process_termination
detection:
  selection:
    Image|endswith:

      - "/Finder"
      - "/Dock"
      - "/Spotlight"
      - "/Terminal"
      - "/Activity Monitor"
      - "/NotificationCenter"
  timeframe: 10s
  condition: selection count() > 20
falsepositives:

  - Legitimate process management or troubleshooting (unlikely to produce >20 kills of system processes in 10s)
level: critical

title: ClickLock Stealer dscl Password Validation from Non-Login-Window Context
id: 9c5e3h4g-6d7f-4c0g-be3h-2c8d4e5f6a7b
status: experimental
description: Detects dscl authonly execution from a process other than loginwindow, consistent with ClickLock credential theft
author: Adverse Trace
date: 2026/07/16
references:

  - https://thehackernews.com/2026/07/new-clicklock-macos-stealer-kills-apps.html
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    CommandLine|contains: "dscl /Local/Default -authonly"
  filter:
    ParentImage|endswith: "/loginwindow"
  condition: selection and not filter
falsepositives:

  - Legitimate administrative scripts using dscl for local authentication testing
level: high

7. Sources

• The Hacker News — "New ClickLock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password" — https://thehackernews.com/2026/07/new-clicklock-macos-stealer-kills-apps.html — 2026-07-16
• The Register — "C'mon, just copy this text string and paste it into your macOS Terminal – it'll fix your computer, honest" — https://www.theregister.com/cyber-crime/2026/07/16/cmon-just-copy-this-text-string-and-paste-it-into-your-macos-terminal-itll-fix-your-computer-honest/5273701 — 2026-07-16

8. Adverse Trace position

Severity: High. ClickLock Stealer is a technically capable, actively developed infostealer with a confirmed European victim base and a coercive mechanism that makes refusal difficult for non-technical users. The theft of Chrome's Safe Storage AES key elevates impact beyond immediate credential loss — it enables persistent offline access to browser-stored passwords and cookies until the victim rotates all sessions. No CISA-KEV entry exists (this is malware, not a CVE). Attribution is unconfirmed; no named actor has been identified and no MITRE profile is available. All technical detail is single-sourced from Group-IB. We assess the risk to EMEA financial services as elevated: macOS endpoints used by trading, wealth management, or crypto-adjacent staff are prime targets, and the ClickFix vector bypasses traditional endpoint controls by relying on user execution. Adverse Trace will monitor for published IOCs (compromised payload host domains, Telegram C2 identifiers), track for named-actor attribution, and update clients if the malware's capabilities expand or if lure domains are identified. Clients should treat this as an active campaign requiring immediate user awareness communications and endpoint hunting for the named LaunchAgent plists.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.