ClickLock Stealer: ClickFix-Delivered macOS Infostealer with GSocket Reverse-Shell Backdoor — Threadlinqs Intelligence
As of 2026-07-16, ClickLock Stealer: ClickFix-Delivered macOS Infostealer with GSocket Reverse-Shell Backdoor is a high-severity malware threat attributed to ClickLock Dev, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-1402 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: ClickLock Dev · FINANCIAL
ClickLock Stealer is a modular macOS infostealer distributed via ClickFix-style phishing pages spoofing a Cloudflare CAPTCHA that trick victims into pasting a Terminal command. It harvests the macOS
ClickLock Stealer is a modular, multi-stage macOS infostealer attributed to the actor tracked as 'ClickLock Dev' by Group-IB. Discovered on VirusTotal on June 9, 2026 with zero detections, the campaign has been active since approximately May 2026 and has compromised at least 100 victims across 33 countries, with over half concentrated in Europe and secondary concentration in North America and the Middle East/Africa.
Initial access uses the ClickFix social-engineering technique: victims land on phishing pages impersonating a Cloudflare 'CAPTCHA ACCESS CONTROL' verification banner (as well as spoofed Claude and disk-cleaner utility pages) that instruct them to open Terminal and paste a single command. That command downloads and executes an orchestrator shell script (script.sh) which disables keyboard interrupts (trap INT), hides the terminal cursor, and displays a fake progress animation while it sequentially downloads and runs four further modules, all hosted on compromised WordPress sites (panalobet[.]ph, store.grafsynergy[.]com) or staging infrastructure (cottonbox[.]co[.]il).
The orchestrator installs LaunchAgent persistence (com.authirity.plist, com.chromer.plist), fingerprints the host (username, macOS version, CPU, RAM, disk, public IP via ifconfig.me), and kills NotificationCenter for roughly six hours to suppress macOS security prompts.
The credential-theft chain has two escalating components. chromer.txt (the Keychain Stealer) queries the macOS Keychain via `security find-generic-password` to steal the Chrome Safe Storage AES key, and runs an aggressive kill-loop terminating Finder, Dock, SystemUIServer, browsers, Terminal, and Activity Monitor every 0.2 seconds for up to 34.7 days to coerce the user into granting Keychain access through attrition. zsh.txt (the Credential Stealer) creates a hidden staging directory ~/.cacheb/, downloads a spoofed Apple icon from store.grafsynergy[.]com/media/apple.png, and displays a fake osascript password dialog; refusal escalates to a kill-loop firing every 210ms for up to ~83 hours. Entered passwords are validated in real time against `dscl /Local/Default -authonly` and logged in plaintext, hex, and base64 before exfiltration via the Telegram Bot API with up to 1,000 retry attempts. Both components apply timestamp forgery (copying mtimes from ~/Movies) after each action to blind forensic timelines, and self-delete via `rm -- "$0"` on completion.
The crypto/browser stealer module (finderv2.jpg, executed as finder.sh piped directly to bash without touching disk) performs comprehensive extraction across 8 browsers (Chrome, Brave, Edge, Opera, Vivaldi, Arc, Chromium, Firefox), 31 Chromium-based crypto wallet extensions (including MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, Rainbow, Exodus, Keplr, Solflare, OKX Wallet, Backpack, Yoroi, Tonkeeper, Xverse, UniSat, Ronin, TronLink, Zerion, MyTonWallet, Bitget, Leather, Bittensor), 7 Firefox wallet extensions (MetaMask, Phantom, Ronin Wallet, Alby, FilSnap, Tonkeeper, Solflare), 8 desktop wallets (Exodus, Coinomi, Electrum, Atomic Wallet, Wasabi Wallet, Bitcoin Core, Feather/Monero, and a listed '1Password' entry), and 7 password manager extensions (Bitwarden, LastPass, Talisman, 1Password, iCloud Passwords, NordPass, Keeper, with Dashlane and Enkrypt also referenced). It extracts blockchain addresses across 6 chains (EVM, Bitcoin, Solana, TRON, TON, Stacks) using the plyvel Python library to parse Snappy-compressed LevelDB blocks, with a proximity-based regex fallback that reassembles encrypted vault components (data/iv/salt) within a 1000-byte window for offline brute-forcing, dispatched through wallet-specific parsers. It also harvests shell history and FileZilla FTP credentials.
The final component (goyim) deploys a GSocket-based backdoor built on a customized version of the legitimate open-source gsocket deploy.sh installer (reusing an estimated 70-80% of the original code). It detects OS/architecture, downloads a pre
Target sectors: individuals, cryptocurrency, finance
Target regions: Europe, North America, Middle East, Africa
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1584, T1584.001, T1587, T1587.001, T1588.002, T1608.001, T1608.002, T1189, T1059.002