A macOS info-stealing malware called ClickLock Stealer uses a fake “Cloudflare verification” page to trick users into copying and running a Terminal command. It then steals browser, crypto wallet, and Keychain data and sends it to attackers via a Telegram bot, while killing processes to hide warnings and force password entry.
ClickLock Stealer relies on a classic ClickFix style trick. Victims land on a page disguised as a Cloudflare verification screen and are instructed to copy a bash command and paste it into macOS Terminal to "verify" themselves. Because the user runs the command themselves, the malware executes with their own privileges rather than needing to exploit a vulnerability. Once active, it collects browser data, crypto wallet and extension data, password manager extensions, Keychain data, FTP credentials, and shell history, then exfiltrates everything to a Telegram bot controlled by the attackers.
The attack succeeds because it turns the user into the delivery mechanism. Rather than exploiting a technical flaw, it relies on a familiar looking verification prompt and a simple copy-paste instruction, something many users have grown used to doing without much thought. The malware then compounds this by suppressing the operating system's own defenses. It kills visible processes, including macOS NotificationCenter, for roughly six hours at a stretch, muting the Gatekeeper and security warnings that would normally raise suspicion. A fake password dialog is kept open in a loop, closing other windows until the victim complies, and a similar tactic is used to coerce approval of Keychain access.
Organizations and individuals can reduce risk by treating any website request to run Terminal commands as a red flag worth stopping and reporting rather than following. Repeated or blocking password prompts should be treated with suspicion, closed, and verified through a known IT or security contact rather than answered directly. Users should not assume macOS warnings will always appear or protect them, since this malware is designed to suppress those signals, so unusual behavior like disappearing notifications or vanishing windows deserves attention. Finally, any unexpected request to grant Keychain or browser credential access should be denied and reported, since this can expose saved passwords, crypto wallets, and other sensitive stored data (T1566.002, T1204.001, T1059.004, T1656, T1555).
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
ClickLock Stealer is a macOS info-stealing malware that lures victims to a fake Cloudflare verification page and tricks them into copying and running a bash command in Terminal, which then steals browser, crypto wallet, and Keychain data.
It repeatedly kills processes, including macOS NotificationCenter, for hours at a time to suppress Gatekeeper and other security warnings that would otherwise alert the victim.
The malware displays a fake macOS password dialog and closes every other visible window or app so the victim has no choice but to enter their password or approve Keychain access to make it go away.
According to the findings, the campaign has targeted more than 100 users across 33 countries and can affect any macOS user, including executives, finance staff, developers, and IT helpdesk personnel.
On a Mac and see a “Cloudflare verification” page telling you to run a Terminal command? That’s how ClickLock Stealer gets in. ClickLock lures you to a ClickFix-style page disguised as Cloudflare, tells you to paste a bash command into Terminal, and you actually download and run the malware yourself with your own privileges. Then it gets sneaky: a fake macOS password dialog takes over your screen, other apps vanish, notifications are silently killed for hours, and it keeps asking until you type your Mac password and approve Keychain access. Aha moment: any website that tells you to run a Terminal command is almost certainly a scam. Stop, close it, and report it to security immediately, do not paste that command.
Researchers documented a real macOS data-stealing campaign that relies on social engineering instead of software bugs. Victims are sent to a fake “verification” page that tells them to copy and paste a command into Terminal, which silently installs a stealer and then pressures them to enter their…
Researchers found a new macOS infostealer, “ClickLock Stealer,” that uses ClickFix-style fake verification pages to trick people into running Terminal commands. After infection, it shows a realistic macOS password prompt and can effectively lock the Mac until the victim enters the correct password,…
Researchers observed a real macOS information-stealing campaign that tricks victims into pasting a command into Terminal from a “ClickFix” web page. After running, the malware shows a fake macOS password prompt and can repeatedly crash key apps (Finder/Dock/browsers) for hours or days to pressure…
Researchers found an active campaign using fake AWS sign-in pages and an Apple ID decoy page to pull victims onto attacker-controlled websites. Visiting these pages can trigger an iOS exploit chain that installs GHOSTBLADE and steals sensitive data like iCloud, Keychain, and Wi‑Fi credentials.
Okta says it gained an inside look at “Work Panel,” a polished SaaS-style dashboard that helps voice-phishing (vishing) crews rapidly set up fake login sites and guide victims through password and MFA capture. The tool clones brand look-and-feel for services like Okta and Microsoft 365, then lets a…
Researchers found a DocuSign lookalike phishing workflow that guides people through a realistic “document viewing” experience and then convinces them to download legitimate remote access tools. Instead of classic malware, the attackers install trusted IT administration software (RMM) to keep…
