ClickLock Stealer forces macOS password with rapid app kill

A new and aggressive form of malware targeting macOS systems, dubbed ClickLock Stealer, is using a combination of social engineering and relentless process termination to coerce users into surrendering their login passwords, according to research published by cybersecurity firm GroupIB. The malware, which has infected at least 100 systems across 33 countries since May, steals a wide array of sensitive data including browser credentials, cryptocurrency wallet information, and password manager vaults.

The attack begins when users are lured to a fake webpage, likely through search engine poisoning or compromised sites, that displays a fraudulent Cloudflare CAPTCHA or human verification check. Victims are instructed to copy and paste a specific command into the macOS Terminal application. Executing this command downloads and runs an orchestrator script that fetches four additional malicious components from compromised legitimate websites.

A key feature of ClickLock is its coercive mechanism designed to obtain the user's system password. The malware initially presents a fake macOS password dialog. If the user enters the password, it is validated and then exfiltrated to the attackers...