ClickLock macOS Stealer Forces Password via Kill Loops

How the Attack Worked

This macOS campaign, tracked by Group-IB, began with a ClickFix-style lure: a webpage instructed victims to copy and paste a command into Terminal to complete a supposed verification step. Once executed, an orchestrator script hid the cursor and played a fake Cloudflare progress animation while quietly downloading four components from two compromised WordPress sites. This gave the victim a plausible, familiar-looking loading experience while the real payload was staged in the background.

The Coercion Mechanism

After installation, a credential module displayed a fake AppleScript password dialog styled to look like a native macOS system prompt. The dialog validated any entered password locally against the directory service, so only correct passwords were forwarded to the operator. If the victim did not comply immediately, a kill loop repeatedly terminated Finder, Dock, browsers, Terminal and Activity Monitor in a tight cycle that could run for up to 83 hours, effectively making the Mac unusable until the victim gave in and typed their password.

Why It Succeeded

• The lure exploited familiarity with legitimate verification and troubleshooting steps, making the Terminal command feel like a normal fix rather than a red flag.
• The fake progress animation mimicked a trusted security vendor's look and feel, reducing suspicion during the download phase.
• The kill loop turned normal desktop use into a source of stress, pushing victims toward the fastest way to make the disruption stop: entering their password.
• Local validation of the password meant the fake dialog behaved convincingly like a real system prompt, with no obvious errors to expose it as fraudulent.

What to Watch For

• Any website that asks you to paste a command into Terminal, regardless of the stated reason.
• Unexpected password prompts that are not tied to an action you initiated, such as installing approved software.
• Apps like Finder, Dock, or your browser repeatedly closing or crashing right after you cancel a prompt.
• A system that becomes unusable until a password is entered, which should be treated as a pressure tactic, not a legitimate requirement.

Building Resistance

Teams should train macOS users, especially developers and IT staff who are more comfortable using Terminal, to treat paste-and-run instructions as an automatic stop signal. If a Mac suddenly starts killing applications in a loop, the safer response is a force shutdown and a boot into Safe Mode rather than entering credentials into an untrusted dialog. Reinforcing that legitimate macOS updates and verification steps never require pasting commands into Terminal can help staff recognize and resist this specific coercion pattern before credentials or wallet data are exposed.

What is the ClickLock macOS stealer attack?

It is a real information-stealing campaign that tricks macOS users into pasting a command into Terminal from a fake verification webpage, which then downloads malware, shows a fake password dialog, and can disrupt the desktop until the victim enters their password.

Why does the malware keep closing my apps?

After the fake password prompt appears, a kill loop repeatedly terminates Finder, Dock, browsers, Terminal and Activity Monitor for up to 83 hours to pressure the victim into typing their password.

What should I do if a website tells me to paste a command into Terminal?

Treat it as an attack attempt and stop immediately; researchers urged users to view any such instruction as malicious, not a legitimate fix or verification step.

What data does this malware steal?

It targets browser passwords, cookies, Keychain and Chrome Safe Storage keys, and more than 30 crypto wallet extensions including MetaMask and Phantom, exfiltrating everything over Telegram bots.