ClickLock Tricks Mac Users Into Running Malware

How the Attack Worked

ClickLock Stealer relies on a classic ClickFix style trick. Victims land on a page disguised as a Cloudflare verification screen and are instructed to copy a bash command and paste it into macOS Terminal to "verify" themselves. Because the user runs the command themselves, the malware executes with their own privileges rather than needing to exploit a vulnerability. Once active, it collects browser data, crypto wallet and extension data, password manager extensions, Keychain data, FTP credentials, and shell history, then exfiltrates everything to a Telegram bot controlled by the attackers.

Why It Succeeded

The attack succeeds because it turns the user into the delivery mechanism. Rather than exploiting a technical flaw, it relies on a familiar looking verification prompt and a simple copy-paste instruction, something many users have grown used to doing without much thought. The malware then compounds this by suppressing the operating system's own defenses. It kills visible processes, including macOS NotificationCenter, for roughly six hours at a stretch, muting the Gatekeeper and security warnings that would normally raise suspicion. A fake password dialog is kept open in a loop, closing other windows until the victim complies, and a similar tactic is used to coerce approval of Keychain access.

What to Watch For

• A "verification" step that asks you to open Terminal and run a command
• Unexpected instructions to copy and paste bash commands from a webpage
• A password prompt that reappears repeatedly or blocks other windows
• Other open apps or windows suddenly closing without explanation
• Security notifications or warnings that stop appearing as expected

Building Resistance

Organizations and individuals can reduce risk by treating any website request to run Terminal commands as a red flag worth stopping and reporting rather than following. Repeated or blocking password prompts should be treated with suspicion, closed, and verified through a known IT or security contact rather than answered directly. Users should not assume macOS warnings will always appear or protect them, since this malware is designed to suppress those signals, so unusual behavior like disappearing notifications or vanishing windows deserves attention. Finally, any unexpected request to grant Keychain or browser credential access should be denied and reported, since this can expose saved passwords, crypto wallets, and other sensitive stored data (T1566.002, T1204.001, T1059.004, T1656, T1555).

What is ClickLock Stealer?

ClickLock Stealer is a macOS info-stealing malware that lures victims to a fake Cloudflare verification page and tricks them into copying and running a bash command in Terminal, which then steals browser, crypto wallet, and Keychain data.

How does ClickLock Stealer bypass macOS security warnings?

It repeatedly kills processes, including macOS NotificationCenter, for hours at a time to suppress Gatekeeper and other security warnings that would otherwise alert the victim.

How does ClickLock trick users into giving up their password?

The malware displays a fake macOS password dialog and closes every other visible window or app so the victim has no choice but to enter their password or approve Keychain access to make it go away.

Who is at risk from this attack?

According to the findings, the campaign has targeted more than 100 users across 33 countries and can affect any macOS user, including executives, finance staff, developers, and IT helpdesk personnel.