ClickLock Stealer: ClickFix-Delivered macOS Infostealer with GSocket Reverse-Shell Backdoor
ClickLock Stealer (TL-2026-1402), also tracked as ClickLock, is a high-severity malware campaign, first published 2026-07-16. It is attributed to ClickLock Dev with low confidence, affects Apple macOS, maps to 69 MITRE ATT&CK techniques (T1005, T1016, T1020), and is covered by 9 detection rules and 28 indicators of compromise.
Key facts for TL-2026-1402
- Threat ID
- TL-2026-1402
- Also known as
- ClickLock
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-16
- Last reviewed
- 2026-07-16
- Attribution
- ClickLock Dev
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- individuals, cryptocurrency, finance
- Target regions
- Europe, North America, Middle East, Africa
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in ClickLock Stealer
Malware and tooling: ClickLock Stealer, GSocket / gs-netcat
ClickLock Stealer is a modular macOS infostealer distributed via ClickFix-style phishing pages spoofing a Cloudflare CAPTCHA that trick victims into pasting a Terminal command. It harvests the macOS login password, Chrome Safe Storage keys, data from 8 browsers, credentials from 31 Chromium and 7 Firefox crypto wallet extensions, 8 desktop wallets, and 7 password manager extensions, and installs a GSocket-based reverse-shell backdoor for persistent remote access.
How ClickLock Stealer works
ClickLock Stealer is a modular, multi-stage macOS infostealer attributed to the actor tracked as 'ClickLock Dev' by Group-IB. Discovered on VirusTotal on June 9, 2026 with zero detections, the campaign has been active since approximately May 2026 and has compromised at least 100 victims across 33 countries, with over half concentrated in Europe and secondary concentration in North America and the Middle East/Africa.
Initial access uses the ClickFix social-engineering technique: victims land on phishing pages impersonating a Cloudflare 'CAPTCHA ACCESS CONTROL' verification banner (as well as spoofed Claude and disk-cleaner utility pages) that instruct them to open Terminal and paste a single command. That command downloads and executes an orchestrator shell script (script.sh) which disables keyboard interrupts (trap INT), hides the terminal cursor, and displays a fake progress animation while it sequentially downloads and runs four further modules, all hosted on compromised WordPress sites (panalobet[.]ph, store.grafsynergy[.]com) or staging infrastructure (cottonbox[.]co[.]il).
The orchestrator installs LaunchAgent persistence (com.authirity.plist, com.chromer.plist), fingerprints the host (username, macOS version, CPU, RAM, disk, public IP via ifconfig.me), and kills NotificationCenter for roughly six hours to suppress macOS security prompts.
The credential-theft chain has two escalating components. chromer.txt (the Keychain Stealer) queries the macOS Keychain via `security find-generic-password` to steal the Chrome Safe Storage AES key, and runs an aggressive kill-loop terminating Finder, Dock, SystemUIServer, browsers, Terminal, and Activity Monitor every 0.2 seconds for up to 34.7 days to coerce the user into granting Keychain access through attrition. zsh.txt (the Credential Stealer) creates a hidden staging directory ~/.cacheb/, downloads a spoofed Apple icon from store.grafsynergy[.]com/media/apple.png, and displays a fake osascript password dialog; refusal escalates to a kill-loop firing every 210ms for up to ~83 hours. Entered passwords are validated in real time against `dscl /Local/Default -authonly` and logged in plaintext, hex, and base64 before exfiltration via the Telegram Bot API with up to 1,000 retry attempts. Both components apply timestamp forgery (copying mtimes from ~/Movies) after each action to blind forensic timelines, and self-delete via `rm -- "$0"` on completion.
The crypto/browser stealer module (finderv2.jpg, executed as finder.sh piped directly to bash without touching disk) performs comprehensive extraction across 8 browsers (Chrome, Brave, Edge, Opera, Vivaldi, Arc, Chromium, Firefox), 31 Chromium-based crypto wallet extensions (including MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, Rainbow, Exodus, Keplr, Solflare, OKX Wallet, Backpack, Yoroi, Tonkeeper, Xverse, UniSat, Ronin, TronLink, Zerion, MyTonWallet, Bitget, Leather, Bittensor), 7 Firefox wallet extensions (MetaMask, Phantom, Ronin Wallet, Alby, FilSnap, Tonkeeper, Solflare), 8 desktop wallets (Exodus, Coinomi, Electrum, Atomic Wallet, Wasabi Wallet, Bitcoin Core, Feather/Monero, and a listed '1Password' entry), and 7 password manager extensions (Bitwarden, LastPass, Talisman, 1Password, iCloud Passwords, NordPass, Keeper, with Dashlane and Enkrypt also referenced). It extracts blockchain addresses across 6 chains (EVM, Bitcoin, Solana, TRON, TON, Stacks) using the plyvel Python library to parse Snappy-compressed LevelDB blocks, with a proximity-based regex fallback that reassembles encrypted vault components (data/iv/salt) within a 1000-byte window for offline brute-forcing, dispatched through wallet-specific parsers. It also harvests shell history and FileZilla FTP credentials.
The final component (goyim) deploys a GSocket-based backdoor built on a customized version of the legitimate open-source gsocket deploy.sh installer (reusing an estimated 70-80% of the original code). It detects OS/architecture, downloads a precompiled gs-netcat binary from gsocket.io/bin, and on macOS disguises the binary as 'iCloud' inside ~/Library/Application Support/iCloudsync while masquerading its running process as 'SystemUIServerl'. Persistence is layered across crontab injection, shell RC file modification (.bashrc/.zshrc), and a LaunchAgent — and unlike every other component, it does not self-delete. It connects to the GSocket relay gsnc[.]eu:67 for an AES-encrypted PTY reverse shell and sends host reconnaissance (username, OS, CPU, RAM, external IP) plus an initial connection secret through three redundant channels: HTTP webhook, Telegram bot, and DNS.
ClickLock requires no exploits or elevated privileges to operate, relying entirely on social engineering and TCC-permission attrition. Its dual-mode approach (soft persuasion escalating to a hard kill-loop denial-of-service against the user's own desktop) and extensive timestamp forgery make it notably resistant to both user refusal and post-incident forensic analysis.
MITRE ATT&CK techniques used in TL-2026-1402
Collection
T1005 Data from Local System; T1056 Input Capture; T1119 Automated Collection; T1560 Archive Collected Data; T1560.001 Archive via Utility; T1560.002 Archive via Library
Discovery
T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087 Account Discovery; T1087.001 Local Account; T1217 Browser Information Discovery; T1518.001 Security Software Discovery
Exfiltration
T1020 Automated Exfiltration; T1030 Data Transfer Size Limits; T1567 Exfiltration Over Web Service; T1567.002 Exfiltration to Cloud Storage
Defense Evasion
T1027 Obfuscated Files or Information; T1027.016 Junk Code Insertion; T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location; T1036.008 Masquerade File Type; T1070 Indicator Removal; T1070.004 File Deletion; T1070.006 Timestomp; T1070.009 Clear Persistence; T1564 Hide Artifacts; T1564.001 Hidden Files and Directories; T1564.003 Hidden Window
Credential Access
T1056.002 GUI Input Capture; T1111 Multi-Factor Authentication Interception; T1187 Forced Authentication; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1552.001 Credentials In Files; T1552.003 Shell History; T1555 Credentials from Password Stores; T1555.001 Keychain; T1555.003 Credentials from Web Browsers; T1555.005 Password Managers
Execution
T1059.002 AppleScript; T1059.004 Unix Shell; T1204 User Execution; T1204.004 Malicious Copy and Paste
Command and Control
T1071 Application Layer Protocol; T1071.001 Web Protocols; T1071.004 DNS; T1090.003 Multi-hop Proxy; T1102 Web Service; T1102.003 One-Way Communication; T1132 Data Encoding; T1573 Encrypted Channel
Initial Access
Impact
T1489 Service Stop; T1499 Endpoint Denial of Service
Persistence
T1543 Create or Modify System Process; T1543.001 Launch Agent
Privilege Escalation
Resource Development
T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1584.001 Domains; T1587 Develop Capabilities; T1587.001 Malware; T1588.002 Tool; T1608.001 Upload Malware; T1608.002 Upload Tool
defense-impairment
Affected products and versions in ClickLock Stealer
- Apple — macOS
Vulnerable versions: all supported macOS versions (no exploit required) - Google — Chrome / Chromium browsers (Brave, Edge, Opera, Vivaldi, Arc, Chromium)
Vulnerable versions: all versions storing Safe Storage keys in macOS Keychain - Mozilla — Firefox
Vulnerable versions: all versions with logins.json/key4.db profile storage
Remediation for ClickLock Stealer
Immediate actions
- Block outbound network traffic to panalobet[.]ph, store.grafsynergy[.]com, cottonbox[.]co[.]il, and gsnc[.]eu:67
- Never paste or execute Terminal commands presented by a webpage, regardless of purported source (Cloudflare, Claude, disk-cleaner utilities)
- Alert on and block outbound connections to api.telegram.org from non-browser, non-messaging processes
- Search endpoints for LaunchAgents com.authirity.plist and com.chromer.plist and the hidden directory ~/.cacheb/
- Search for the process/file masquerading as 'iCloud' at ~/Library/Application Support/iCloudsync and process name 'SystemUIServerl'
- Rotate credentials and revoke sessions for any browser-stored passwords, crypto wallet seed phrases, and password-manager vaults on suspected-compromised macOS hosts
- Revoke and reissue Chrome Safe Storage Keychain entries and force re-authentication across browsers on affected hosts
Workarounds
- Disable clipboard-to-Terminal paste execution via macOS security tooling where feasible
- Restrict or monitor osascript-spawned dialog boxes that reference downloaded/remote icon assets
Longer-term hardening
- Deploy EDR with behavioral detection for rapid pkill/killall loops targeting Finder, Dock, SystemUIServer, and browsers at sub-second intervals
- Enforce TCC/Full Disk Access monitoring and alert on unexpected grants to Terminal.app
- Deploy DNS/network-layer blocking for known GSocket relay infrastructure and monitor for gs-netcat process signatures
- User security-awareness training specifically addressing ClickFix-style 'paste this command' social engineering
- Harden crontab and shell RC file (.zshrc/.bashrc) integrity monitoring on managed macOS fleets
Timeline of ClickLock Stealer
- ClickLock Stealer campaign begins active distribution via ClickFix-style phishing pages spoofing Cloudflare CAPTCHA verification, per Group-IB's approximate May 2026 start estimate.
- Orchestrator script (script.sh) first uploaded to VirusTotal with zero detections, marking the first documented sample discovery.
- Campaign infrastructure expands to include compromised WordPress hosting on panalobet[.]ph and store.grafsynergy[.]com for staged payload delivery.
- Cumulative victim count reaches at least 100 confirmed victims across 33 countries, with more than half located in Europe.
- GSocket-based backdoor component (goyim) analyzed, revealing reuse of ~70-80% of the legitimate open-source gsocket deploy.sh installer code and connection to relay gsnc[.]eu:67.
- Threat added to Threadlinqs Intelligence Platform following Group-IB public disclosure.
- Analysis confirms the credential-theft components route stolen data through three distinct Telegram bots for redundancy, while the GSocket backdoor separately confirms its initial connection secret over three parallel channels (HTTP webhook, Telegram bot, DNS).
- Group-IB's code-structure analysis assesses ClickLock Stealer as still under active development, indicating further module changes and evasion updates should be expected in subsequent variants.
- Group-IB publishes full technical analysis of ClickLock Stealer, attributing the campaign to the 'ClickLock Dev' threat actor and detailing all five malware components.
Sources cited for ClickLock Stealer
- ClickLock Stealer macOS malware analysis
- GitHub - hackerschoice/gsocket: Connect like there is no firewall. Securely.
- GSocket Backdoor via Bash Script on Linux and macOS
- GSocket Backdoor Delivered Through Bash Script
- New macOS ClickFix attack silently mounts DMGs to push infostealer
- Evil evolution: ClickFix and macOS infostealers
- ClickFix Campaigns Targeting Windows and macOS
- ClickFix campaign uses fake macOS utilities lures to deliver infostealers
- Invisible Reverse Shells: How gsocket Backdoors Hide in Plain Sight
Threats related to ClickLock Stealer
- ClickLock Stealer: macOS ClickFix Infostealer Uses 210ms Process-Kill Loops and Fake Authentication Dialogs to Coerce Credentials
- ClickLock: New macOS Infostealer Uses ClickFix Lure and App-Killing LaunchAgents to Force Credential Entry
- Meow Mac Stealer RAT: macOS ClickFix Lures Deploy AppleScript Infostealer with Persistent RAT Capabilities
- Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT, Grok) to Distribute Malware
- CrashStealer: Novel macOS Information Stealer Disguised as Apple Crash Reporter (Jamf Threat Labs)
- macOS ClickFix Campaign Silently Mounts Malicious DMGs (hdiutil attach -nobrowse) to Deploy Atomic macOS Stealer (AMOS)
Detection coverage for TL-2026-1402
As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1402 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.